This rule detects binaries that attempt to enumerate PspCreateProcessNotifyRoutine kernel callbacks using BYOVD read primitives.