BQTLock/QEMU Payload PyInstaller and Debugger Detection Anti-Analysis
This rule identifies suspicious activity associated with PyInstaller-packaged executables (specifically 'BQT.exe' and 'start.exe'). It detects these processes directly, or any processes that initiate them while referencing anti-analysis markers like debugger checks ('IsDebuggerPresent'), internal PyInstaller environment variables, or specific path markers like '_MEIPASS'. This behavior is characteristic of malware attempting to evade sandbox or manual analysis.
Microsoft Sentinel (KQL)
