VILE Ransomware Decryptor Shortcut and Icon Drop via PowerShell

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

This rule detects PowerShell activity attempting to drop specific files associated with VILE ransomware, including 'vile_Decryptor.lnk' onto the desktop and 'vile_icon.ico' into the temporary directory, using the -NoProfile flag to bypass profile script execution.