Create kernelDriverLoader.yar

kernelDriverLoader.yar

@@ -0,0 +1,19 @@
+rule Temporary_Driver_Injection
+{
+    meta:
+        description = "Detects kernel driver injection using NtLoadDriver with a temporary file"
+        author = "0x12 Dark Development"
+        technique = "Temporary Driver Injection"
+        reference = "https://maldev.example.com/temp-driver-injection"
+
+    strings:
+        $reg_key     = "SYSTEM\\CurrentControlSet\\Services\\" wide ascii
+        $image_path  = "\\??\\C:\\Users\\" wide ascii
+        $temp_hint   = "\\AppData\\Local\\Temp\\" wide ascii
+        $ntloaddriver = "NtLoadDriver" ascii
+        $sys_ext     = ".sys" ascii
+        $drv_prefix  = "DRV" ascii
+
+    condition:
+        all of them
+}