BQTLock: start.exe PyInstaller loader dropping and executing BQT.exe ransomware

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects a suspicious process execution chain where 'start.exe' or 'BQT.exe' is identified in a parent-child relationship. Specifically, it flags 'start.exe' spawning 'BQT.exe', or 'BQT.exe' subsequently invoking 'vssadmin.exe' with the 'delete shadows' command, which is a common technique used by ransomware to prevent system recovery.