Millenium RAT Registry Run Key Persistence via Unsigned Binary in User Directories
Detects modifications to Windows Registry Run keys (HKCU or HKLM) by suspicious processes (cmd, powershell, wscript, cscript, node). The detection specifically looks for cases where the written value points to a binary located in user-writable or temporary directories and the binary itself is unsigned or has low trust, indicating a potential persistence mechanism being established.
CQL
