BYOVD Kernel Driver Drop and Service Registration for EDR Callback Zeroing

Renata Cardoso@rcardososec

•updated Jul 1, 2026•0•0•4

This rule correlates the creation of a new .sys file (excluding standard Windows driver directories) with the subsequent execution of sc.exe to register a kernel service. This behavior is indicative of an attacker attempting to load a malicious driver, often for persistence or rootkit capabilities, using a potentially non-standard path.