BYOVD: DCRCVDrv.sys Driver Drop, Exact Service/Device Match & IOCTL 0x2205c0 Kill

Duo Tech@duotech

•updated Aug 17, 2026•9•0•9

Detects the BYOVD kill chain for the DCRCVDrv.sys driver: drop to C:\Windows\Temp\, DCRCVDRV_U/LEGACY_DCRCVDRV_U service installation, device open, and IOCTL 0x2205c0 invocation used to terminate security/EDR processes from kernel context.