{
  "driverModel": "wdm",
  "relatedDDIs": [
    "PsCreateSystemThread",
    "PsGetVersion",
    "PsSetCreateProcessNotifyRoutine",
    "PsSetCreateThreadNotifyRoutine",
    "PsSetLoadImageNotifyRoutine",
    "PsTerminateSystemThread"
  ],
  "ruleName": "IrqlPsPassive"
}