Threat Hunt: Shanya BYOVD Activity - vulnerable Driver Drops and Loads
This KQL query identifies potential Bring Your Own Vulnerable Driver (BYOVD) activity associated with the Shanya packer by detecting the creation/modification of known vulnerable or malicious driver files (e.g., ThrottleStop.sys, rwdrv.sys, hlpdrv.sys) and their subsequent loads, a technique used to gain kernel access for disabling EDR/AV tools in ransomware attacks.
Microsoft Sentinel (KQL)
