Sality Botnet - IPFILTERDRIVER Service Installation

Georg Lauenstein@gsec

•updated Sep 11, 2026•1•0•2

Detects installation of a service or kernel driver named IPFILTERDRIVER, the network packet-filtering driver used by the Sality P2P botnet (SALTY SPIDER) to block infected hosts from reaching antivirus vendor domains/IPs and to shield the peer-to-peer communication channel from local security tooling. Presence of this service is a high-confidence indicator of Sality infection.