VILE Ransomware Access Token Manipulation via Privilege APIs
This rule monitors process events for the combined usage of multiple Windows security APIs associated with access token manipulation. Specifically, it flags processes that call two or more of the following functions: AdjustTokenPrivileges, LookupPrivilegeValueW, SetTokenInformation, OpenProcessToken, DuplicateTokenEx, or GetTokenInformation. This behavior is indicative of token stealing or impersonation attempts, often used by malware such as Vile Ransomware to escalate privileges or bypass security controls. The rule also includes heuristic filtering for common system processes.
Splunk (SPL)
