VILE Ransomware Direct NT Syscall EDR Bypass via NtCreateWaitCompletionPacket

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects potential ransomware activity (specifically VILE) that utilizes direct NT system calls and specific API interactions (e.g., NtCreateWaitCompletionPacket) to bypass user-mode EDR hooks. The rule monitors for a combination of suspicious process activity, unexpected image loads of ntdll.dll, and specific API calls often associated with evasion techniques in Go-based binaries.