Driver Load - avkiller.sys

Detects loading of driver avkiller.sys via name. Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.