BYOVD: OPSWAT AppRemover driver (pcdhost.sys) loaded to terminate security processes

Ibrahim Saud@tektrix

•updated Jul 3, 2026•18•0•11

This rule monitors for the loading of a specific driver file, 'pcdhost.sys', followed by a process termination event within a five-minute window. This behavior is indicative of a 'Bring Your Own Vulnerable Driver' (BYOVD) attack pattern, where an adversary loads a vulnerable driver to gain kernel-level access or elevate privileges, often followed by the cleanup or termination of the process that facilitated the loading.