BYOVD mass AV/EDR process termination via Alinubx/NvFsFilter driver

Ibrahim Saud@tektrix

•updated Sep 19, 2026•1•0•4

This rule detects a high frequency of process terminations occurring within a 5-minute window on a device where specific driver-related processes or command lines ('nvfsflt64.sys', 'Alinubx.sys') have been identified. Such behavior is characteristic of malicious activity attempting to disrupt system security components or clear traces, potentially indicating an endpoint denial of service or evasion attempt.