EnCase BYOVD - User-Mode DeviceIoControl to Driver

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•1

This rule detects attempts by user-mode utilities to interact with the loaded EnCase driver via DeviceIoControl, specifically targeting paths containing 'EEDbg' or 'EnCase'. This activity is indicative of a Bring Your Own Vulnerable Driver (BYOVD) attack, where an EDR killer utility leverages a legitimate driver's functionality to execute arbitrary ring-0 commands, potentially bypassing security controls.