VILE Ransomware Decryptor Shortcut and Icon File Drop via PowerShell

Ibrahim Saud@tektrix

•updated Jun 27, 2026•1•0•4

This rule detects PowerShell processes initiated where the command line contains references to specific files ('vile_Decryptor.lnk' or 'vile_icon.ico'), which are indicative of suspicious shortcut file execution or associated malware staging activity.