Suspicious NvFsFilter Kernel Driver Service Installation (Alinubx.sys)

Ibrahim Saud@tektrix

•updated Sep 22, 2026•2•0•8

Detects the installation of a Windows service that mimics the legitimate NVIDIA File System Filter Driver (NvFsFilter). Adversaries, such as those associated with the Rapuncel infostealer, use this technique to establish persistence and evade security controls by masquerading as a common driver component.