Grixba VEH Registration for Debugger Evasion and Execution Hijacking
This rule detects the registration of a Vectored Exception Handler (VEH) by specific process names (gt_net.exe, grixba) or processes running from suspicious paths (e.g., C:\Users\Public\Music). This behavior is associated with the Grixba component of Play ransomware, which uses VEH for anti-debugging and execution hijacking.
Splunk (SPL)
