EDRSandBlast BYOVD vulnerable driver load followed by EDR/security process termination

Ethan Andrews@eandrews

•updated Jul 2, 2026•6•0•9

Detects the loading of a potentially vulnerable or unauthorized third-party kernel driver from outside the standard system driver directory, followed shortly (within 30 minutes) by the termination of security product processes or services. This behavioral pattern is indicative of 'Bring Your Own Vulnerable Driver' (BYOVD) exploitation, often used to impair security tools and blind EDR/antivirus solutions.