DragonForce Huawei Driver Abuse for Defense Evasion (BYOVD)
Detects the loading of known vulnerable or unsigned drivers, specifically targeting Huawei-signed driver variants, which have been leveraged by DragonForce for Bring Your Own Vulnerable Driver (BYOVD) defense evasion. The rule identifies driver loads where the file name matches known vulnerable Huawei drivers or where the driver is loaded by an unusual process and not from a standard system directory, and is also untrusted.
Microsoft Sentinel (KQL)
