BYOVD kernel driver install followed by mass AV/EDR kill (Alinubx/nvfsflt64.sys)

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•4

This rule detects a multi-stage attack pattern consistent with a Bring Your Own Vulnerable Driver (BYOVD) chain. It identifies the installation of specific known vulnerable drivers (e.g., Alinubx.sys, nvfsflt64.sys) and the registration of a corresponding service (NvFsFilter), followed by the mass termination of various security software and EDR processes within a short timeframe. This behavior is indicative of an adversary using kernel-mode privileges to disable security controls.