Suspicious Driver Load
This KQL query analyzes driver load events on Windows endpoints to detect malicious activity. It specifically looks for drivers (.sys files) being loaded from non-standard, user-writable directories. The query checks for DriverLoad events and filters for files ending with .sys. It then narrows the results to drivers loaded from suspicious folders like \Users\, \AppData\, and \Temp\. The query uses a comprehensive exclusion list to filter out known legitimate drivers from these locations, such as those related to Windows Defender, specific gaming anti-cheat software, or hardware utilities like CPU-Z, which often operate from temporary directories. The final output is a list of suspicious driver load events that may indicate a malicious driver being executed on the system.
Microsoft Sentinel (KQL)
