Suspicious Environment Variable Modification via Registry
Detects the creation or modification of user-specific or system-wide environment variables in the Windows Registry that contain suspicious commands, strings, or encoded payloads. This rule looks for common indicators of malicious activity such as PowerShell commands, temporary file paths, and various Base64 encoded strings often associated with malware or attacker tools.
Sigma
