EnCase BYOVD - Post-Exploitation Driver Cleanup (T1070.004)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•1

This rule correlates the successful loading of the 'EEDbg.sys' driver with subsequent command-line activity indicating an attempt to stop a service or delete the 'EEDbg.sys' file. This behavior is indicative of an attacker cleaning up forensic evidence after a Bring Your Own Vulnerable Driver (BYOVD) attack, specifically targeting the EnCase EDR's driver.