BYOVD: DCRCVDrv.sys Driver Load Used to Terminate EDR via IOCTL

Ibrahim Saud@tektrix

•updated 15 days ago•2•0•3

Detects the loading or installation of a driver file identified as DCRCVDrv.sys followed within 5 minutes by EDR sensor heartbeat loss or process activity, which is characteristic of attempts to tamper with security software or hide malicious activity via a kernel-mode driver.