Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

BlackByte – RTCore64.sys (GIGABYTE Driver) BYOVD Load

Blackbyte Defense Evasion Sentinel
MITRE ATT&CK
Exploitation for Stealth
Data Source
DeviceFileEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group_tools dataset (blackbyte); public BlackByte BYOVD reporting
What This Detects
BlackByte is documented loading the vulnerable GIGABYTE RTCore64.sys driver (alongside MSI Afterburner/Dell/Zemana drivers) to gain kernel-level read/write access and kill EDR – RTCore64.sys specifically is one of the most well-documented BlackByte BYOVD IOCs.
Query
DeviceFileEvents
| where Timestamp > ago(1d)
| where FileName =~ "rtcore64.sys"
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessAccountName

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.