VILE Ransomware Token Privilege Manipulation via Direct NT Syscalls
Detects evidence of VILE ransomware behavior involving token and privilege manipulation, including the use of Windows API functions such as AdjustTokenPrivileges, OpenProcessToken, and DuplicateTokenEx, as well as potential EDR bypass indicators via NT syscalls like NtCreateWaitCompletionPacket.
YARA-L
