Clfs.SYS Loaded By Process Located In a Potential Suspicious Location — Detection Rule
Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of many CVEs exploits that targets Common Log File.