ModeloRAT WinPython Persistence via HKCU Run Key Impersonating Remote Access Tools
Detects the creation or modification of registry keys in HKEY_CURRENT_USER\Run, targeting registry values related to remote access applications like AnyDesk, Splashtop, or Comms. The rule specifically looks for evidence that these entries are configured to execute Python interpreter executables (e.g., pythonw.exe or WPy64), which can indicate an attempt to maintain persistence using authorized software or masqueraded scripts.
Microsoft Sentinel (KQL)
