VILE Ransomware System Discovery via NT API Calls and C2 Exfiltration
Detects the execution of VILE ransomware by identifying specific dropped file artifacts (vile_icon.ico, vile_deadlines.json, vile_user_files.zip) and correlating these file events with outbound network connections made by the same process to remote non-private IP addresses, indicating the likely exfiltration of harvested system metadata.
Cortex XDR
