Suspicious Vulnerable Driver Blocklist Registry Manipulation Through CommandLine (via process_creation)

This rule detects tampering of the Vulnerable Driver Blocklist registry via command line tools such as PowerShell or REG.EXE. The Vulnerable Driver Blocklist is a security feature that helps prevent the loading of known vulnerable drivers. Disabling this feature may indicate an attempt to bypass security controls, frequently targeted by threat actors to facilitate the installation of hostile or vulnerable drivers, particularly in scenarios involving Endpoint Detection and Response