Gentlemen RaaS BYOVD: Known Vulnerable Driver Load to Kill Security Products
This rule detects the loading or execution of known vulnerable kernel drivers. These drivers are often leveraged by adversaries in Bring Your Own Vulnerable Driver (BYOVD) attacks to achieve privilege escalation by exploiting vulnerabilities in the driver to execute code in kernel mode.
CQL
