Rapuncel NvFsFilter Malicious Service Installation (Alinubx.sys)

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•2

This rule detects activities related to the loading or registration of the 'NvFsFilter' driver (nvfsflt64.sys). It monitors for command-line attempts to interact with services (using sc.exe, reg.exe, or services.exe), registry modifications involving the NvFsFilter service, and the actual loading of the nvfsflt64.sys file. This is intended to identify potential persistence mechanisms or the deployment of potentially unauthorized or malicious drivers.