Grixba Infostealer VEH Registration via AddVectoredExceptionHandler

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects the execution of the Grixba infostealer, which registers a Vectored Exception Handler (VEH) using AddVectoredExceptionHandler. This behavior is used by the malware for execution hijacking and debugger evasion to maintain persistence and prevent analysis. The rule monitors for processes identified as Grixba based on specific naming conventions or execution from suspicious paths like C:\Users\Public\Music\.