BYOVD - SeLoadDriverPrivilege Acquisition (T1134)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•1•0•4

Detects user-mode processes abnormally requesting the SeLoadDriverPrivilege token privilege, which is required to load vulnerable drivers into the kernel. This activity is often associated with Bring Your Own Vulnerable Driver (BYOVD) attacks.