AV/EDR Process or Service Termination Following g11.sys Driver Load

Ethan Andrews@eandrews

•updated Jul 9, 2026•6•0•10

Detects termination of security services or tampering with real-time protection configurations shortly after the loading of the PoisonX (g11.sys) kernel driver. This activity is indicative of a Bring Your Own Vulnerable Driver (BYOVD) attack aimed at disabling endpoint defenses prior to the deployment of ransomware or other malicious payloads.