DeadLock BYOVD EDR Termination
Detects the loading of a vulnerable Baidu Antivirus driver (CVE-2024-51324), a technique used by DeadLock ransomware, followed by the termination of a security product process on the same host. This indicates a 'Bring Your Own Vulnerable Driver' (BYOVD) attack to disable defenses.
Sigma
