EnCase BYOVD - Malicious Driver Service Creation (T1543.003)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•1

Correlates the dropping of the vulnerable driver with sc.exe creating a kernel-level service to load it into memory.