EnCase BYOVD - SeLoadDriverPrivilege Acquisition

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•1

Detects anomalous user-mode processes requesting the SeLoadDriverPrivilege token privilege, which is essential for loading the EnCase driver (EEDbg.sys) into the kernel. This activity is indicative of a Bring Your Own Vulnerable Driver (BYOVD) attack using the EnCase driver.