Suspicious Driver Installation via Pnputil.exe
This rule detects the use of 'pnputil.exe' to install or add drivers on a Windows system. Adversaries may use this utility to install malicious or vulnerable drivers for privilege escalation, persistence, or to bypass security controls. The detection specifically looks for command-line arguments indicative of driver installation, such as '-i', '/install', '-a', '/add-driver', and the presence of '.inf' in the command line.
Sigma
