BQTLock PyInstaller Loader (start.exe) Spawning BQT.exe Ransomware
Detects execution patterns associated with the BQTLock ransomware, specifically the PyInstaller-packaged 'start.exe' binary acting as a loader to spawn 'BQT.exe' or other child processes, identified by specific PyInstaller environment artifacts in the command line.
Microsoft Sentinel (KQL)
