msagent.sys kernel driver load followed by targeted module enumeration

Duo Tech@duotech

•updated Aug 14, 2026•11•0•71

Detects msagent.sys kernel driver load events immediately followed by targeted module/filter enumeration (driverquery/fltmc) referencing the same driver.