LokiBot MachineGuid Registry Read from User-Writable Process Location
Detects instances where a process executing from a user-writable directory (e.g., Temp, AppData) reads the HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid registry key. This behavior is a known technique utilized by the LokiBot information stealer to derive a host-specific mutex for tracking infections.
Sigma
