Multiple Driver File Creations or Modifications

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

This rule detects when five or more driver-related files (.inf, .sys, or .drv) are created or modified within a one-hour window by the same initiating process account. This behavior can be indicative of malicious driver installation, rootkit activity, or other forms of persistence or privilege escalation.