MiniPlasma Registry Link Creation
Detects modifications to the 'BlockedApps' registry key within the CloudFiles policy path, specifically looking for symbolic link setups pointing to the Volatile Environment as used in the MiniPlasma LPE exploit.
Sigma

