Payouts King Direct Syscall EDR Bypass - Security Process Termination

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

This rule monitors for two high-confidence indicators of malicious activity: the execution of known Payouts King ransomware binaries and the termination of security software processes by non-system actors, which is indicative of defensive evasion techniques such as syscall abuse.