The Gentlemen BYOVD Vulnerable Driver Load for Security Product Termination

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•9

Detects the loading of known vulnerable drivers (e.g., ProcessMonitorDriver.sys, inpoutx64.sys) associated with 'The Gentlemen' RaaS group, used in BYOVD attacks to elevate privileges and terminate security products.