OilRig APT Registry Persistence

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•20

Detects registry persistence used by the OilRig APT group, specifically looking for modifications to the 'SOFTWARE\Microsoft\Windows\CurrentVersion\UMe' or 'SOFTWARE\Microsoft\Windows\CurrentVersion\UT' registry keys. This activity was reported by Nyotron in their March 2018 report.