BYOVD vulnerable driver filenames rwdrv.sys and hlpdrv.sys

Emiliano Mema@Nosalva

•updated Aug 18, 2026•2•0•7

Detects the presence of known vulnerable drivers (rwdrv.sys and hlpdrv.sys) associated with 'Bring Your Own Vulnerable Driver' (BYOVD) attacks. Adversaries utilize these drivers to gain kernel-level access, allowing them to disable security software, escalate privileges, or maintain persistence.