BYOVD Kernel Driver Load - Alinubx.sys (CcProtect.sys)

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•3

Detects the loading of the kernel driver 'Alinubx.sys', identified as a renamed instance of the 'CcProtect.sys' driver. This driver is known to be abused in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security software processes from kernel mode, specifically observed in the context of Rapuncel infostealer campaigns.