TOKYOCORE Process Enumeration Against Debugger/VM/AV Blocklists
Detects instances where the TOKYOCORE malware (fsociety.exe) attempts to identify or enumerate the presence of security-critical applications, including debuggers, virtual machine guest agents, and antivirus/EDR software. This behavior is indicative of malware attempting to evade analysis or disable security controls.
Cortex XDR
