BYOVD DCRCVDrv.sys Vulnerable Driver Dropped for EDR Kill

Ibrahim Saud@tektrix

•updated Sep 21, 2026•1•0•4

Detects the creation of a file named 'DCRCVDrv.sys'. This filename is historically associated with malicious kernel-mode drivers used in cyberattacks, such as the DCRDRV exploit or related persistence/evasion mechanisms involving driver installation.