Processes Running as PPL (Protected Process Light) — Ransomware / Privilege Abuse
This rule detects suspicious activities related to Protected Process Light (PPL) and driver loading that could indicate privilege escalation, defense evasion, or impact. Specifically, it looks for: 1. Processes running with 'System' integrity that were initiated by a process with a lower integrity level, which could suggest an attempt to elevate privileges. 2. Driver image load events where 'ntoskrnl.exe' is the initiating process, but the driver is loaded from a location outside of the standard 'System32' or 'System32\drivers' directories. This could indicate an adversary attempting to load malicious drivers to evade detection or persist. 3. DriverLoad actions initiated by 'ntoskrnl.exe' from outside the standard 'System32' or 'System32\drivers' directories, similar to the image load events, pointing to potential malicious driver activity.
Microsoft Sentinel (KQL)
