BYOVD - Driver Self-Deletion Cleanup (T1070.004)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•10

Identifies the EDR Killer utility deleting the vulnerable .sys driver and its associated service after the EDR has been permanently blinded. This rule specifically looks for 'cmd.exe' executing commands to delete services ('sc delete') or delete .sys files ('del *.sys'), combined with a driver load event for a .sys file.