ResiLoader BYOVD: pcdhost.sys (OPSWAT AppRemover) Loaded from Non-Standard Path

Ibrahim Saud@tektrix

•updated Jul 3, 2026•3•0•8

Detects the loading of the vulnerable OPSWAT AppRemover driver (pcdhost.sys) from a non-standard file path, often used as a Bring Your Own Vulnerable Driver (BYOVD) technique by the ResiLoader malware to elevate privileges and gain kernel-level access to terminate security software. The rule also monitors for mass process termination events indicative of successful security product disabling.