Kernel Driver Unload/Disable Attempt

Ankit Mehta@Secvyn

•updated Jun 17, 2026•0•0•4

Detects attempts to unload, disable, or remove kernel drivers, which could indicate a rootkit or other malicious activity trying to hide its presence or impair system defenses. The rule specifically looks for process creation events (EventID 4688) where the command line contains keywords related to driver manipulation ('unload driver', 'disable driver', 'remove driver') and also references kernel components ('.sys', 'kernel').