ClearFake BYOVD: DCRCVDrv.sys Load/Write & DCRCVDRV_U Device Abuse
Detects the loading or usage of the malicious driver 'DCRCVDrv.sys' associated with the ClearFake crypto stealer campaign, which uses a Bring-Your-Own-Vulnerable-Driver (BYOVD) technique to interact with the device path '\Device\DCRCVDRV_U' to terminate or impair EDR and security tools.
Microsoft Sentinel (KQL)
