Kernel Driver Service ImagePath Pointing to Non-Standard Location

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects kernel driver service ImagePath registry values that point to non-standard locations outside typical Windows driver directories. This may indicate attempts to load malicious or vulnerable kernel drivers for persistence or privilege escalation, a technique commonly observed in EDR-killer tools that drop a driver to a non-standard location before loading it for further exploitation. It's recommended to first baseline this rule in your environment and adjust it accordingly before enabling it in production.

2026-09-02 00:00:00

None

4a9c1e73-6f2d-4b87-c3a5-8d0f2b5e7196

attack.privilege-escalation attack.persistence attack.t1543.003

Nextron Sigma feed only (private)