[LastPass-Delphos] Rapuncel BYOVD - Microsoft-Attested CnCrypt Driver Killing 145 AV/EDR via IOCTL 0x222024

Ankit Mehta@Secvyn

•updated Sep 18, 2026•0•0•0

This rule detects the loading of specific drivers identified as potentially associated with security software evasion or 'Bring Your Own Vulnerable Driver' (BYOVD) tactics, followed by suspicious process termination activity (e.g., termination of security-related processes or system-critical process activity) within a 15-minute window on the same device.