Monkey Ransomware C++ Defense Evasion Chain (AMSI/ETW/Log/History Wipe)

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•4

Detects multiple defense evasion techniques typically associated with the Monkey ransomware family, including clearing Windows Event Logs, clearing PowerShell command history, tampering with AMSI and ETW, modifying Microsoft Defender exclusions, and disabling Task Manager or CMD via registry keys.