BQTLock Anti-Analysis: PyInstaller Environment and Debugger Detection
Detects BQTLock ransomware anti-analysis checks, specifically looking for processes named 'start.exe' or 'BQT.exe' that exhibit characteristics of PyInstaller environments (via environment variables) or log anti-debugging failure messages. This rule helps identify the initial stages of BQTLock execution where it attempts to evade analysis.
Microsoft Sentinel (KQL)
