Suspicious BYOVD Driver Load for Defense Evasion

Ethan Andrews@eandrews

•updated Feb 28, 2026•7•0•50

Detects the loading of specific vulnerable drivers ('zam64.sys', 'UpdateCheckerX64.sys') used by ransomware groups like CrazyHunter and Interlock to terminate security products. The query combines multiple data sources to detect different stages of BYOVD activity, including driver file creation, registry entries for service creation, and command-line activity related to driver loading.