ResiLoader BYOVD: OPSWAT AppRemover Driver (pcdhost.sys) Loaded to Kill Security Tools

Ibrahim Saud@tektrix

•updated Jul 3, 2026•0•0•4

This rule monitors for the installation or loading of a specific driver file, 'pcdhost.sys', through file creation, registry modifications for services, or image loads. It then correlates this activity with subsequent rapid process termination events on the same host, flagging cases where five or more processes are terminated within a 5-minute window following the driver activity.