drvsvc service stop/delete followed by drv.sys removal (G12/G13 killer redeploy)

Ethan Andrews@eandrews

•updated Aug 4, 2026•0•0•1

Detects a malicious teardown sequence involving the 'drvsvc' service being stopped or deleted in the registry, followed by the deletion of the 'C:\Windows\System32\drivers\drv.sys' file within a 15-minute window. This behavior is indicative of a driver redeployment process, often associated with the removal of security-disabling components.