BYOVD driver hunting via bd_test_*.bat sc create kernel service registration

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•3

This rule detects the execution of specific suspicious batch scripts (e.g., 'bd_test_k7old.bat') via cmd.exe, or the creation of a Windows service involving kernel drivers using sc.exe, which may indicate testing of defensive mechanisms or the deployment of potentially malicious kernel-level components.