Rootkit

Monitor for loading of unsigned or unusual kernel drivers using Sysmon Event ID 6 and driver block rules. Enable Microsoft Defender for Endpoint's attack surface reduction rules to block known vulnerable drivers and use memory integrity (HVCI) to prevent unsigned driver loading.