BYOVD - In-Memory Malware Execution Post-Kill (T1055)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•6

Detects the W2 Malvertising loader waiting for the EDR to be killed before performing cross-process injection (Process Hollowing) into a new legitimate binary. This rule correlates the loading of a new, non-Windows driver with subsequent process memory injection within a 5-minute window, indicating potential BYOVD (Bring Your Own Vulnerable Driver) attacks followed by in-memory malware execution.