Potential Ursnif Malware Registry Key Creation

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•24

This rule detects the creation of specific registry keys under 'Software\AppDataLow\Software\Microsoft\' that are known to be associated with Ursnif malware. The rule filters out common legitimate registry paths used by Internet Explorer, RepService, IME, and Edge to reduce false positives.