BlogSecurity Operations
Threat IntelligenceCrowdStrikeBYOVDDetection EngineeringNGSIEMInfostealerCQL

Current News, Working Detections: Hunting the Rapuncel Infostealer in CrowdStrike

A threat report dropped on September 17 describing a fake LastPass Authenticator installer that kills 145 security tools from kernel mode. Here's how to turn the report's defender hunting section into CQL you can run in CrowdStrike NGSIEM today.

Luis Torres-Villarreal

This post is a worked example of a repeatable workflow: a threat report publishes, the defender hunting section describes what to look for, and this translates those indicators and behaviors into CQL statements you can run in CrowdStrike Falcon NGSIEM. Sources: The Hacker News and the joint LastPass / Delphos Labs report, both published September 17, 2026.

The Campaign

On August 13, 2026, the LastPass TIME team identified a fraudulent GitHub organization (github.com/LastPass-Authenticator) ranking in search results for “LastPass Authenticator download.” Visitors were routed through a GitHub Pages redirect chain to attacker-controlled servers delivering oversized ZIPs (127-148 MB, padded with junk to bypass automated scanners). The infostealer, tracked internally as Rapuncel, was one of at least 40 brand impersonations running on the same infrastructure. Its kernel driver is a renamed copy of CcProtect.sys (CnCrypt, by Henan Dafeng Software), submitted through Microsoft’s Hardware Compatibility program for attestation signing. It had zero VirusTotal detections when researchers checked it in August.

The attack chain uses DLL side-loading via a renamed vsdbg.exe (Microsoft’s own debugger) to load a malicious companion DLL, escalates to SYSTEM through one of three UAC bypass methods, installs the driver as a service named NvFsFilter (nvfsflt64.sys), and from kernel mode terminates 145 AV and EDR processes. With security tools down, the stealer collects browser passwords from 25+ applications, crypto wallet files, Discord, Steam, and Telegram sessions, and Windows Credential Manager contents. The key detail for defenders: the operators renamed the driver to erase hash-based detection, but the PE version metadata (company name, product name) embedded in the binary did not change. That is where the durable detection lives.

Hunting It in CrowdStrike NGSIEM

The joint report’s defender hunting section identifies five specific indicators. The queries below cover all five, plus two behavioral detections derived from the attack chain itself. Queries are written for CrowdStrike Falcon NGSIEM (LogScale HQL). If you’re running Event Search on the legacy endpoint, drop the # prefix from #event_simpleName.

Q1 - Service name IOC: NvFsFilter

The driver installs itself as a Windows service with this exact name. Direct IOC - highest confidence, lowest durability.

#event_simpleName = "ServiceInstalled"
| ServiceObjectName = "NvFsFilter"
| table([ComputerName, UserName, ServiceObjectName, ServiceDisplayName,
         ServiceImagePath, timestamp])

Q2 - Driver file IOC: nvfsflt64.sys

Catches the file write to disk before or separate from the service install event.

#event_simpleName = "PeFileWritten"
| TargetFileName = /(?i)nvfsflt64\.sys/
| table([ComputerName, UserName, TargetFileName, ParentBaseFileName,
         SHA256HashData, timestamp])

Q3 - Signer IOC: Henan Dafeng Software / CnCrypt (rename-resistant)

PE version metadata survives file renames. This is the most durable query in this set - it matches the underlying driver regardless of what the operators call the file next time.

// DriverCompanyName / DriverProductName may require ImageInfo enrichment
// depending on sensor version. If those fields return null, pair with Q4.
#event_simpleName = "DriverLoad"
| (
    DriverCompanyName = /(?i)(henan dafeng|cncrypt)/ OR
    DriverProductName = /(?i)cncrypt/ OR
    DriverSignatureAuthority = /(?i)(henan dafeng|cncrypt)/
  )
| table([ComputerName, ImageFileName, DriverCompanyName, DriverProductName,
         DriverSignatureAuthority, DriverSignatureValidity, SHA256HashData, timestamp])

Q4 - Filename IOC: Alinubx or nvfsflt64

The report identifies the device path \\.\Alinubx as an indicator. CrowdStrike surfaces this at driver load time via the image filename. Catches both known campaign names in one query.

#event_simpleName = "DriverLoad"
| ImageFileName = /(?i)(alinubx|nvfsflt64)/
| table([ComputerName, ImageFileName, DriverCompanyName, DriverProductName,
         DriverSignatureAuthority, DriverSignatureValidity, SHA256HashData, timestamp])

Q5 - Behavior: security process kills after driver load

Two queries to run together, correlated by ComputerName or aid. Part A finds security tools that exited unexpectedly. Part B finds non-standard signed driver loads on the same hosts during the same window.

Part A - Security process unexpected exits:

#event_simpleName = "ProcessRollup2"
| ImageFileName = /(?i)(MsMpEng\.exe|msmpeng|WinDefend|CsAgentService|CSFalcon|
                         SentinelAgent\.exe|CylanceSvc\.exe|cb\.exe|carbonblack|
                         bdagent\.exe|avguard\.exe|ekrn\.exe|mcshield\.exe|
                         SophosHealth\.exe|mbamservice\.exe)/
| TerminationCode != null
| table([ComputerName, aid, ImageFileName, TerminationCode, ParentBaseFileName, timestamp])
| sort(timestamp, order=desc)

Part B - Signed driver loaded outside standard Windows paths (same host):

#event_simpleName = "DriverLoad"
| DriverSignatureValidity = "1"
| NOT ImageFileName = /(?i)(\\Windows\\System32\\drivers\\|
                             \\Windows\\System32\\DriverStore\\|
                             \\Windows\\WinSxS\\|\\Windows\\SysWOW64\\)/
| table([ComputerName, aid, ImageFileName, DriverCompanyName,
         DriverSignatureAuthority, timestamp])
| sort(timestamp, order=desc)

Q6 - DLL side-loading: vsdbg.exe outside Visual Studio paths

vsdbg.exe is the .NET Core debugger distributed with Visual Studio and VS Code. Its only legitimate locations are inside a Visual Studio or SDK install path. Running from a temp folder, AppData, or a download directory is the side-loading setup.

#event_simpleName = "ProcessRollup2"
| ImageFileName = /(?i)\\vsdbg\.exe$/
| NOT ImageFileName = /(?i)(\\Microsoft Visual Studio\\|
                             \\Program Files\\Microsoft Visual Studio\\|
                             \\\.vs\\|\\packages\\vsdbg\\)/
| table([ComputerName, UserName, ImageFileName, CommandLine,
         ParentBaseFileName, ParentImageFileName, SHA256HashData, timestamp])

Q7 - BYOVD broad catch-all (campaign-agnostic)

The operators renamed the driver once to drop hash-based detection from 7 engines to zero. They can do it again. This query catches the BYOVD pattern itself - a legitimately signed driver loaded from a non-standard path - regardless of filename or hash.

Use this as a hunting query, not a detection alert. Expect noise from legitimate third-party drivers; tune by adding NOT DriverCompanyName exclusions for vendors you trust.

#event_simpleName = "DriverLoad"
| DriverSignatureValidity = "1"
| NOT DriverCompanyName = /(?i)(microsoft|intel|nvidia|amd|realtek|qualcomm|
                                 broadcom|vmware|oracle|lenovo|dell|hp)/
| NOT ImageFileName = /(?i)(\\Windows\\System32\\drivers\\|
                             \\Windows\\System32\\DriverStore\\|
                             \\Windows\\WinSxS\\)/
| table([ComputerName, ImageFileName, DriverCompanyName, DriverProductName,
         DriverSignatureAuthority, timestamp])
| sort(timestamp, order=desc)

The Pattern

Every threat report that publishes a “what to hunt for” section is handing you raw query material. The Rapuncel report listed five specific indicators. That list maps directly to event types CrowdStrike already logs: service installs, PE file writes, driver loads with signing metadata, and process exits. The work is translation, not research.

The durable detection in this set is Q3: the PE metadata signer hunt. The operators changed the filename once and erased hash-based detection. They did not change the company name, product name, or version fields embedded in the driver binary, because doing so requires recompiling with a new signing request. That’s not nothing. It means the IOC with the longest shelf life is not the one that gets emailed around in a threat feed. It’s the one that requires reading the full report and understanding why the rename worked.

That is the workflow. Read the report. Find the section that describes what to hunt. Ask what CrowdStrike event type captures each indicator. Write the query. This set took thirty minutes.

All indicators in this post are derived from the publicly available LastPass / Delphos Labs joint report. IOC data (domains, hashes) was deliberately excluded: the operators have already rotated infrastructure and file hashes are only valid until the next rename. Hunt by behavior and metadata.

Hunting threats but lacking the security leadership to operationalize detections across your team? See how a fractional CISO can own that function.

Disclaimer: The AI-assisted workflows described in this article are intended to augment human judgment, not replace it. All agent outputs (verdicts, recommendations, and draft actions) require human review and verification before execution. Use of agentic tooling in security must align with your organization's policies, change management procedures, and applicable compliance requirements.

Luis Torres-Villarreal is a Senior Leader with 15+ years in IT, Information Security, PCI DSS, HITRUST, NIST CSF, and SOC 2 Type II compliance. He writes about AI agents, Security Automation, and the evolution of InfoSec Teams.

Need a hand with this at your company?

543HQ helps startups and growing companies build security programs that actually work. Start with a free 30-minute call.

Book a Free Call