BYOVD - Kernel Service Creation for Vulnerable Driver

Ibrahim Saud@tektrix

•updated Jun 23, 2026•2•0•5

Detects the sc.exe utility creating a kernel-mode driver service pointing to a newly dropped .sys file in a temporary user directory. This activity is indicative of Bring Your Own Vulnerable Driver (BYOVD) techniques, often used by attackers to gain kernel-mode privileges and bypass security solutions.