NvFsFilter service persistence with repeated AV/EDR process restart loop
Detects the installation or configuration of the NvFsFilter (Alinubx.sys) persistence driver, often associated with malicious behavior that continuously terminates security software processes to allow for persistent unauthorized activity after system reboots.
Microsoft Sentinel (KQL)
