MiniPlasma windir Registry Modification
Identifies modifications to the Volatile Environment registry key altering the windir value to a non-standard path, a prerequisite setup step for the MiniPlasma LPE exploit.
Microsoft Sentinel (KQL)
Identifies modifications to the Volatile Environment registry key altering the windir value to a non-standard path, a prerequisite setup step for the MiniPlasma LPE exploit.
Already have an account?