Threat Hunt: APT35 - Subtle Snail - Persistence via Registry Run - RunOnce
Detects registry persistence attempts via Run and RunOnce keys in both user and machine hives, focusing on value names and data referencing known Subtle Snail malicious files and suspicious payload names. Tracks registry modifications indicating adversary attempts to maintain persistent execution through stealthy implant DLLs and executables.
Microsoft Sentinel (KQL)
