Kkrat Byovd Rtcore64 Suspicious Driver Load

Tim Peck@timpeck

•updated Sep 10, 2025•1•1•42

Detects the loading of the vulnerable RTCore64.sys driver. This driver is exploited by threats like kkRAT to disable AV/EDR security callbacks as part of a Bring Your Own Vulnerable Driver (BYOVD) attack.