VILE Ransomware Go Binary Direct NT Syscall EDR Evasion

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•5

This rule detects activities associated with VILE ransomware, focusing on unsigned Go-based binaries. It flags processes performing cross-process operations, creating specific file artifacts (e.g., vile_deadlines.json, vile_Decryptor), or invoking direct NT system calls such as NtCreateWaitCompletionPacket to evade EDR hooks.