Known Vulnerable/Malicious Driver Load
This rule detects the loading of kernel-mode drivers that match hashes identified as vulnerable or malicious by the LOLDrivers project. This is a common indicator of 'Bring Your Own Vulnerable Driver' (BYOVD) attacks, where adversaries exploit legitimate, signed drivers with known vulnerabilities to gain kernel-mode code execution or elevate privileges.
Microsoft Sentinel (KQL)
