Sauron Ransomware pre-encryption registry and system info reconnaissance

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

This rule detects potential registry enumeration activities targeting sensitive Windows system keys ('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion' or 'HKLM\HARDWARE\DESCRIPTION') that are associated with the execution of suspicious processes named 'systemki.exe' or 'sysklnd.exe'. These filenames are consistent with historical observations of the Sauron (also known as Strider) malware framework.