BYOVD gdrv.sys Driver Load (Settra Ransomware)

Ankit Mehta@Secvyn

•updated Sep 18, 2026•0•0•1

Detects the loading of the 'gdrv.sys' driver, which is a known vulnerable driver often used in 'Bring Your Own Vulnerable Driver' (BYOVD) attacks to facilitate privilege escalation to kernel mode.