The Gentlemen BYOVD Vulnerable Driver Drop and Service Install

Ibrahim Saud@tektrix

•updated Jun 30, 2026•5•0•6

Detects the drop or installation of known vulnerable drivers associated with the 'The Gentlemen' ransomware group's Bring Your Own Vulnerable Driver (BYOVD) tactics, or the creation of kernel-mode services by unsigned binaries. These techniques are often used to gain kernel-level privileges and disable security software.