All Detections

Coldriver Persistence UserInitMprLogonScript

avatar
Tim Peck@timpeck
updated Sep 25, 20250103

Detects the modification of the 'UserInitMprLogonScript' registry key to execute a PowerShell script with a hidden window. This persistence technique was used by the COLDRIVER APT group.

YARA-L