Rapuncel/Alinubx.sys BYOVD Mass AV-EDR Process Termination Burst

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•3

Detects when a high volume of distinct security-related processes or services are terminated on a single host within a 2-minute window. This behavior is strongly indicative of an adversary attempting to disable endpoint protection software as part of a post-compromise defensive evasion effort.