BYOVD Driver Service Install for AV Killer (Bumblebee/Akira rwdrv/hlpdrv)

Emiliano Mema@Nosalva

•updated Aug 28, 2026•0•0•2

Detects the loading of potential Bring Your Own Vulnerable Driver (BYOVD) drivers, specifically those known to be utilized for bypassing endpoint security controls. This rule triggers on specific driver filenames or drivers loaded from non-standard, user-writable directories (e.g., %TEMP%, Public), which are common tactics for dropping and executing malicious kernel-mode code.