BYOVD: OPSWAT AppRemover Driver (pcdhost.sys) Registered to Kill Security Software

Ibrahim Saud@tektrix

•updated Jul 3, 2026•3•0•4

Detects indicators of a malicious driver or associated activity named 'pcdhost.sys'. The rule monitors for the installation of this driver via 'sc.exe', registry modifications related to this filename, the creation of this file on disk, and specific suspicious process command-line artifacts ('AtLorenBase', 'MANPO: ReadModule', 'PERS: FAIL', 'RUNPE:', 'POST: hollow=') typically associated with malware or offensive toolkits.