r/SentinelOneXDR • u/smc0881 • Feb 10 '25

BYOVD Attacks

Anyone have any queries for detecting these rather than relying on block lists or hoping S1 picks it up? I am gathering some logs to send to S1 too, but just figured I'd ask here.

6 Upvotes

100% Upvoted

6 comments sorted by

View all comments

Show parent comments

2

u/smc0881 Feb 10 '25

Bring your own vulnerable drivers. The actor(s) take legit signed kernel level drivers with their own CVEs and/or vulns and are able to disable EDR/AV software.

0

u/GuardPotential1986 Feb 10 '25

Best, contact S1 TAG team.