Telemetry-Generator v0.5: verified driver unload candidates and Driver Modification

Windows telemetry generator fixes and hardening for driver testing.

Fixed

• Driver load/unload (T1685): the script now verifies the kernel image transition with an independent module snapshot (NtQuerySystemInformation) before and after the service start/stop, so a successful service control call cannot masquerade as a load or unload. Exit codes: 0 = load and unload verified; 1 = nothing loaded; 2 = image loaded but the unload could not be verified (the image stays resident until reboot; the run log records the exit code).
• Driver unload candidates: the default candidate list now starts with in-box drivers verified to support dynamic unload (wimmount.sys, applockerfltr.sys, ndisuio.sys, wcnfs.sys) and uses their existing stopped services where present, leaving them in place. This corrects the v0.4 guidance: rdpdr.sys is no longer used by default because stopping it can disrupt active RDP sessions.
• Endpoint protection note: kernels with driver-load protection (for example Sophos) can block or quarantine non-in-box driver images; prefer the in-box candidates on such endpoints.

Added

• Driver Modification: new self-contained script (DriverModification/Invoke-DriverModification.ps1) that copies a stock in-box driver to a uniquely named image, registers it as a stopped demand-start service, appends a fixed benign marker to the never-loaded copy with before/after SHA-256 evidence, then restores the original bytes and removes the copy and the service. config.json and telemetry-mappings.csv now include the category.

Notes

• windows.zip contains the updated Windows generator; macOS.zip and Linux.zip are unchanged from v0.4.
• Validated end-to-end on a network-isolated Windows 10 test VM with Sophos installed (detection-only): full load+unload cycle verified (exit 0); driver modification verified, restored and cleaned up (exit 0).