• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Suspicious Vulnerable Driver Load (BYOVD)

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Tim Peck@timpeck
    •updated Apr 27, 2026•2•0•234

    Detects the loading of known vulnerable drivers commonly abused in Bring Your Own Vulnerable Driver (BYOVD) attacks to bypass Driver Signature Enforcement (DSE) and gain Ring 0 execution.

    Sigma

    Tags

    T1068 - Exploitation for Privilege EscalationT1543.003 - Windows ServiceTA0004 - Privilege EscalationTA0005 - Defense EvasionTA0003 - PersistenceDriver LoadExploit AttemptMalware DetectedWindowsWindows Sysmonattack.privilege-escalationattack.defense-evasionattack.t1068attack.t1543.003

    Found in

    • Kernel-Level Anti-Cheat Architecture and Evasion TechniquesLast updated Apr 27, 2026

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?