Alinubx.sys BYOVD EDR Killer - Kernel AV/EDR Process Termination

Ibrahim Saud@tektrix

•updated 21 days ago•7•0•1

Detects the loading or presence of the Alinubx.sys kernel driver, a malicious component used for Bring Your Own Vulnerable Driver (BYOVD) attacks. This driver facilitates the mass termination of security product processes (AV/EDR) by exposing a specific IOCTL (0x222024) to interface with kernel-mode process termination primitives (e.g., ZwTerminateProcess), often serving as a precursor to the deployment of stealers like Rapuncel.