The Gentlemen BYOVD CVE-2026-3102: Vulnerable Driver Drop and Kernel Service Install
Detects indicators of 'Bring Your Own Vulnerable Driver' (BYOVD) attacks or suspicious kernel driver installations. The rule monitors for known vulnerable driver files being written to disk, unauthorized creation of .sys files in temporary directories, the installation of new kernel driver services via System Event ID 7045 (referencing temp paths or known malicious drivers), and the use of the sc.exe utility to create services with a kernel driver type.
Cortex XDR
