This kernel mode driver monitors system events and passes them to the Behavior Monitoring Core Service for policy enforcement.