splunkdrv is kernel mode filter driver for Windows registry. Essentially it allows Splunk to listen to every call to registry and log it as a registry event. Windows implements its driver framework such that it allows such lightweight filter drivers to be plugged into existing drivers such as registry file system, etc.
