WINEKEY/Team9 Registry Run Key Modification

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•14

Detects potential malicious modification of the 'Run' registry key by malware identified as 'winekey' or 'team9' (Bazar/KEGTAP) to establish persistence. Specifically, it looks for modifications to the 'Software\Microsoft\Windows\CurrentVersion\Run\Backup Mgr' registry value.