Vulnerable EnCase Driver 'OemHwUpd.sys' Activity

nomit vyas@xoxo

•updated Jun 23, 2026•1•0•7

Detects the creation or loading of the vulnerable EnCase forensic driver 'OemHwUpd.sys'. This driver is being exploited in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security products.