VILE Ransomware Anti-Debug and Sandbox Evasion via RtlGetCurrentPeb and Tagged Pointer Pack
Detects evidence of anti-debugging techniques commonly associated with VILE Ransomware. The rule monitors process information including command lines, descriptions, and file paths for strings such as 'RtlGetCurrentPeb', 'taggedPointerPack', 'gcstoptheworld', and specific ransomware-related markers, indicating that a process is attempting to detect or evade analysis environments.
Splunk (SPL)
