.NET Loader - Decoy PDF Marker File Generation (T1497)
Detects the loader deliberately dropping marker files when it identifies an analysis environment. This rule specifically looks for the creation of files named "vm.txt", "Debugger.txt", or "01_detect_analisse_process.txt", which are known indicators of malware attempting to detect virtualized or debugging environments.
Microsoft Sentinel (KQL)
