Vulnerable driver load followed by security tool tampering on same device

ills3c Intel&Coffee@Ills3C

•updated 5 days ago•6•0•7

Detects a sequence where an unsigned or untrusted kernel driver is loaded from a user-writable path (potentially indicating a Bring Your Own Vulnerable Driver / BYOVD pattern), followed by a security tampering attempt or antivirus tamper event on the same device within a 30-minute window.