Potential Persistence Via Disk Cleanup Handler - Registry Key Creation
Detects when an attacker modifies values of the Disk Cleanup Handler in the registry to achieve persistence. The disk cleanup manager is part of the operating system and allows users to enable or disable individual handlers. It is extensible, allowing developers to implement and register their own disk cleanup handlers. This rule specifically looks for the creation of new registry keys under 'SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\' which could indicate a malicious handler being registered for persistence, while filtering out known legitimate default entries.
Sigma
