SilverFox Registry Infection Markers: ODBDC, JDBCC, and Sauron Keys

Ethan Andrews@eandrews

•updated Jun 22, 2026•1•0•6

Detects creation or modification of SilverFox/Sauron campaign-specific registry keys (Software\ODBDC, SOFTWARE\JDBCC, SOFTWARE\Sauron) and the 'revbs' value name used as infection state tracking markers.