BTR.sys DriverLoad from Non-Defender Process (cmd/powershell)
This rule detects the loading of specific, known-vulnerable kernel drivers (based on their SHA256 hashes) when triggered by administrative command-line utilities such as cmd.exe or powershell.exe. This behavior is highly characteristic of 'Bring Your Own Vulnerable Driver' (BYOVD) attacks, where adversaries exploit vulnerabilities in legitimate, signed drivers to gain elevated (often SYSTEM or kernel) privileges.
Microsoft Sentinel (KQL)
