Threat Hunt: Tracking suspicious driver inventory to unearth rootkits

Awais Munir@iawais

•updated Jul 14, 2025•5•1•79

Detects suspicious driver loads indicative of rootkits or BYOVD attacks. Flags unsigned/non-Microsoft drivers loaded from temp paths or by unusual processes. Targets random-named drivers (e.g., 'a1b2c3.sys'), known vulnerable drivers, and system driver impersonators.