Grixba ntdll EDR Unhooking via PAGE_READWRITE from C:\Users\Public\Music\

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects the execution of the Grixba infostealer, associated with the Play Ransomware group, which is known to perform ntdll EDR unhooking. The rule specifically monitors the launch of the identified malicious binary (Gt_net.exe or GT_NET.exe) from the C:\Users\Public\Music\ directory, a behavior observed consistently across Grixba versions.