The Gentlemen - BYOVD Vulnerable Driver Load

Georg Lauenstein@gsec

•updated Mar 26, 2026•0•40

Detects loading of vulnerable signed drivers used by The Gentlemen for BYOVD-based EDR/AV termination at kernel level. Known drivers include ThrottleBlood.sys (renamed ThrottleStop.sys) and viragt64.sys.