Gentlemen RaaS BYOVD Driver Drop Detection
Detects the creation of specific vulnerable driver files abused by Gentlemen RaaS EDR killers. Gentlemen operators rapidly deploy new BYOVD proofs-of-concept to evade and disable host defenses by dropping known vulnerable drivers to disk.
Microsoft Sentinel (KQL)
