Payouts King Direct Syscall EDR Bypass via ntdll Zw* Export Walk
Detects behavior patterns associated with Payouts King ransomware, including direct syscall-style API calls (NtAllocateVirtualMemory, NtWriteVirtualMemory, CreateRemoteThread) from processes other than trusted system binaries, and the loading of ntdll.dll from non-standard file paths (outside System32/SysWOW64). It also includes a hash-based detection for known Payouts King malicious samples.
Microsoft Sentinel (KQL)
