Alinubx.sys driver load followed by mass AV/EDR process kill

Ibrahim Saud@tektrix

•updated Sep 22, 2026•1•0•6

This rule detects the loading of the known vulnerable NvFsFilter (Alinubx) driver, followed by the abrupt cessation of multiple active AV/EDR processes within a 30-minute window. This behavior is indicative of a Bring Your Own Vulnerable Driver (BYOVD) attack, where the driver is used to execute kernel-mode commands to terminate security software, bypassing standard protection mechanisms.