Vulnerable Driver Blocklist Registry Tampering Via CommandLine

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects tampering of the Vulnerable Driver Blocklist registry via command line tools such as PowerShell or REG.EXE. The Vulnerable Driver Blocklist is a security feature that helps prevent the loading of known vulnerable drivers. Disabling this feature may indicate an attempt to bypass security controls, often targeted by threat actors to facilitate the installation of malicious or vulnerable drivers, particularly in scenarios involving Endpoint Detection and Response

2026-01-26 00:00:00

None

22154f0e-5132-4a54-aa78-cc62f6def531

attack.defense-evasion attack.t1562.001

Community Rule

Swachchhanda Shrawan Poudel

Merge PR #5811 from @swachchhanda000 - Add New Vulnerable Driver Blocklist and HVCI Tampering Based Rules

2026-01-27