The Gentlemen BYOVD - Vulnerable Driver Load to Disable Security Products
This rule detects activities associated with 'Bring Your Own Vulnerable Driver' (BYOVD) attacks, including the loading of known vulnerable drivers, the installation or configuration of drivers via system services, and the execution of tools known to facilitate driver-based kernel manipulation.
Splunk (SPL)
