Potential Persistence Via DLLPathOverride in Natural Language Key
Detects when an attacker adds a new "DLLPathOverride" value to the "Natural Language" key in the Windows Registry to achieve persistence. This persistence mechanism leverages the "SearchIndexer.exe" process to invoke the malicious DLL.
Sigma
