VILE Ransomware PowerShell -NoProfile Decryptor Shortcut Drop

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•0

This rule detects PowerShell commands or script block executions involving the creation of desktop shortcuts associated with the VILE ransomware decryptor. The rule specifically looks for the usage of WScript.Shell, the -NoProfile flag, and references to 'vile_Decryptor' or 'vile_icon.ico' in the command line or script content.