kqlElastic-2.0from elastic/detection-rules
First Time Seen Driver Loaded
Quality
92
FP risk
—
Forks
0
Views
0
Rule sourcerules/windows/privilege_escalation_driver_newterm_imphash.toml
event.category:"driver" and host.os.type:windows and event.action:"load"