Vidar - Dynamic Byte-by-Byte XOR Decryption Loop (T1140)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•3

Traces the behavior of Vidar resolving its Win32 APIs dynamically in memory using a byte-by-byte XOR reconstruction loop. This rule specifically looks for `WriteProcessMemoryApiCall` events where the target process is `RegAsm.exe` and the buffer size written is less than 256 bytes, which is indicative of small, dynamic code injection or modification often seen in malware unpacking or API resolution.