Akira BYOVD - Vulnerable Driver Load to Kill Security Software
Detects the loading of known vulnerable drivers (rwdrv.sys, hlpdrv.sys) used for potential Bring Your Own Vulnerable Driver (BYOVD) attacks, accompanied by evidence of antivirus tampering through process execution or the creation of suspicious directories related to AV killing utilities.
Splunk (SPL)
