Suspicious Driver Service Registration Path

Tim Peck@timpeck

•updated Mar 2, 2026•13•0•63

Detects the creation of a new Windows service where the binary path points to suspicious, world-writable, or temporary directories. This is a common technique used in Bring Your Own Vulnerable Driver (BYOVD) attacks to load a malicious or vulnerable driver.