Malware Registry Key Activity (IceID/Qakbot)

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•20

Detects the creation or modification of a specific registry key path often used by malware families like IceID and Qakbot for persistence or defense evasion. The rule specifically looks for the registry key ending with '\Software\firm\soft\Name'. This activity has been observed in campaigns distributing malicious OneNote files.