MiniPlasma Registry Modification

Collin Lairamore@Bollinmore

•updated May 31, 2026•1•0•22

This rule detects attempts to create or modify registry keys or values within the '.DEFAULT\Volatile Environment' path or 'Software\Policies\Microsoft\CloudFiles\BlockedApps'. Modifications to these keys can be indicator of the MiniPlasma privilege escalation technique