VILE Ransomware ETW Patching and NtTraceEvent Bypass via Go Binary
Detects indicators of VILE ransomware activity, specifically identifying attempts to suppress Event Tracing for Windows (ETW) via NtTraceEvent patching, alongside execution of low-level NT syscalls and the presence of identified VILE-associated artifact files (e.g., .ico, .zip, .json).
Microsoft Sentinel (KQL)
