Millenium RAT Persistence via Registry Run Key with Obfuscated AppData Path
Detects Millenium RAT establishing persistence by creating a Registry Run key (MsEdgeUpdate) that executes a binary named svchost.exe from an obfuscated AppData subdirectory, or identifies general persistence attempts by creating Registry Run keys pointing to executables within user-writable AppData or Temp directories.
Sigma
