Vulnerable Anti-Cheat Driver Access

Aaron Beardslee@abeardslee

•updated Jan 30, 2026•1•0•32

Detects processes opening a handle to the device symbolic link '\\.\HtAntiCheatDriver'. This is the static interface for the vulnerable GameDriverX64.sys driver (CVE-2025-61155) used by the Interlock ransomware group in Bring Your Own Vulnerable Driver (BYOVD) attacks to disable security software.