Masqueraded Palo Alto Driver (ABYSSWORKER)

Ibrahim Saud@tektrix

•updated Jun 18, 2026•3•0•5

Detects potentially malicious drivers masquerading as Palo Alto components, specifically looking for drivers loaded from the 'drivers' folder that claim to be from 'Palo Alto' but have no signer or an invalid signature. This behavior has been associated with the ABYSSWORKER threat.