Attackers abused a signed but long-revoked EnCase Windows kernel driver in a BYOVD attack to terminate all security tools.
Most security incidents happen in the gap between knowing what matters and actually implementing security controls ...