Alinubx.sys IOCTL 0x222024 Kernel-Mode AV/EDR Process Termination

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•2

This rule detects potential security software tampering by identifying the loading of a specific driver (Alinubx.sys) followed by the termination or interference of common security agent processes within a short timeframe. This behavior is indicative of an adversary attempting to disable endpoint protection using a Bring Your Own Vulnerable Driver (BYOVD) or malicious driver approach.