Anubis/Lindnor BYOVD driver and security-killer file drop burst on one host
Detects the creation or renaming of known vulnerable drivers alongside multiple security-killer executables on a single host within a one-hour window, indicating potential preparation for Bring Your Own Vulnerable Driver (BYOVD) attacks and evasion of security controls.
Microsoft Sentinel (KQL)
