EnCase BYOVD - EDR Process Termination (T1562.001)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•1

Detects the consequence of the BYOVD exploit: the sudden termination or crash of protected EDR/AV processes (MsMpEng.exe, Sense.exe, csrss.exe tampering) in conjunction with the loading of the 'EEDbg.sys' driver, which is associated with the EnCase BYOVD technique.