Suspicious PowerShell Payload Stored in Registry via Corel Value
Detects storage of a PowerShell-based persistent payload in the Windows registry under a non-standard GUID-based key using the Corel value. This technique is used by the final stage of the eScan supply-chain attack to establish stealthy persistence after environment validation.
Sigma
