bedaisy.sys

bedaisy.sys is the kernel half of BattlEye, the anti-cheat from BattlEye Innovations GmbH (Reutlingen, Germany). It is the kernel companion to the user-mode siblings already curated in the Field Guide: BEService.exe (the Windows service that brokers between the kernel and BattlEye's servers) and BEClient.exe (the per-game client component).

The driver is dropped and loaded on demand as a minifilter when a protected game launches, and unloaded again when the game closes. You will only see it on the system while a BattlEye-protected title is actually running. Games covered include Rainbow Six SiegeGameRainbow Six SiegeOpen plate →, PUBG: BattlegroundsGamePUBG: BattlegroundsOpen plate →, Escape from TarkovGameEscape from TarkovOpen plate →, DayZ, ARMA, Squad, War Thunder, Dune: Awakening, and many others.

No CVE has been assigned as of this writing. The driver is on the public LOLDrivers list under a SHA-256 first reported in April 2023, catalogued for the kernel access surface a load-on-demand anti-cheat minifilter requires.

If you see bedaisy.sys on your system without a corresponding BattlEye-protected game running, or if it persists after every BattlEye game is closed, that is the signal worth looking at, not the file itself. The driver is signed by BattlEye Innovations directly; updates flow with whichever game launcher manages your BattlEye install.

bedaisy.sys is listed as a known-vulnerable driver on the public LOLDrivers project. One distinct binary hash matching this filename is on record.