Rapuncel: Alinubx.sys BYOVD kernel-mode mass AV/EDR process termination

Arnold Chan@slaz

•updated Sep 18, 2026•0•0•2

Detects the loading of the Alinubx.sys (aka CcProtect.sys) kernel driver, often dropped as nvfsflt64.sys or registered as NvFsFilter, followed by a rapid, simultaneous termination of security product processes. This activity is indicative of a BYOVD (Bring Your Own Vulnerable Driver) attack chain where kernel-mode primitives are used to terminate EDR/AV processes.