FileFix Execution via TypedPaths Registry Key with Malicious Data
This rule detects attempts to use the Windows registry key 'Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths' to execute potentially malicious commands. It specifically looks for the presence of 'powershell', 'mshta', 'certutil', 'curl', 'bitsadmin', or 'wget' within the registry data associated with this key. This technique can be used for persistence or execution of malicious payloads.
Cortex XDR
