Potential Persistence Via Mpnotify Registry Key
Detects when an attacker registers a new SIP provider for persistence and defense evasion by monitoring modifications to the 'mpnotify' registry key under 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\'. This registry key is associated with Winlogon helper DLLs, which can be abused to execute malicious code during user logon.
Sigma
