Pay2Key Persistence via HKLM Run Key browser.exe in AppData GUID Folder
Detects the modification or creation of Windows Registry Run keys that point to a 'browser.exe' executable located within a user's AppData Local directory. The rule specifically looks for paths matching a UUID pattern, which is characteristic of certain automated malware persistence mechanisms, such as those associated with the Pay2Key ransomware.
Splunk (SPL)
