Process Monitor Driver Creation By Non-Sysinternals Binary — Detection Rule

Detects creation of the Process Monitor driver by processes other than Process Monitor (procmon) itself.