Havoc BYOVD Driver File Creation or Load
Detects the creation or loading of a driver named Havoc.sys in a temporary directory, or the loading of a known vulnerable Huawei audio driver (HWAuidoOs2Ec.sys) identified by its SHA256 hash. This activity is indicative of the Havoc Process Terminator BYOVD tool, often used in recent campaigns to blind EDR solutions.
Microsoft Sentinel (KQL)
