Ransomware Series: BYOVD Vulnerable Driver Load for EDR Termination

Ibrahim Saud@tektrix

•updated 9 days ago•7•0•2

Detects the loading of an unsigned or untrusted kernel driver followed by the termination of known security (AV/EDR) processes within a 10-minute window. This behavioral pattern is indicative of 'Bring Your Own Vulnerable Driver' (BYOVD) exploitation often used by ransomware actors to bypass endpoint security controls.