[LastPass-Delphos] One Kit, Forty Companies - Alinubx Driver Dropped as nvfsflt64.sys with Fake NVIDIA Service NvFsFilter
Detects the creation or modification of specific system driver files (nvfsflt64.sys, Alinubx.sys) combined with the installation or initiation of a Windows service associated with NVIDIA filter names. This behavior is often indicative of persistence mechanisms, potential rootkit activity, or the deployment of vulnerable drivers (BYOVD).
Microsoft Sentinel (KQL)
