LotusLite DadaBank Registry Persistence (MustangPanda)
Detects the creation or modification of a registry run key entry named 'DadaBank' within 'Software\Microsoft\Windows\CurrentVersion\Run'. This specific registry modification is associated with the LotusLite dropper, used by the Mustang Panda threat group, to establish persistence on a compromised system.
Microsoft Sentinel (KQL)
