The Gentlemen BYOVD - Vulnerable Driver Load for Security Product Termination
Detects the dropping, service creation, or execution of known vulnerable drivers and associated BYOVD tools. These tools are used by The Gentlemen RaaS group to escalate privileges to kernel level and terminate endpoint security products.
Microsoft Sentinel (KQL)
