BYOVD - Vulnerable Driver Dropped by W2 Loader (T1068)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•1

Identifies the execution of the W2 malvertising loader dropping known vulnerable drivers (e.g., RTCore64, gdrv, procexp) to disk for the Bring Your Own Vulnerable Driver attack. This rule specifically looks for '.sys' files being created in common temporary or user-specific directories (Temp, AppData\Local, Users\Public) where the initiating process was a web browser (chrome.exe, msedge.exe) or explorer.exe.