DriverSentry

DriverSentry is a desktop endpoint security agent focused on one of the most abused persistence paths on Windows: kernel and driver installation. It continuously monitors driver load/install events, correlates them with certificate reputation, known-vulnerable driver lists (BYOVD), and unusual install chains (e.g., unsigned helper binaries, LOLBins). When risk is high, it can block the driver, quarantine the installer, and generate an incident bundle (hashes, signer info, event timeline) for IT or a SOC. The product is intentionally narrow: it doesn’t try to replace EDR. Instead, it plugs a common gap for smaller orgs that run Microsoft Defender but lack deep kernel telemetry and driver allowlisting discipline. A lightweight policy mode supports “observe first” to avoid breaking legitimate hardware/software deployments.