NUKESPED zlrenu8.exe Registry and System Info Discovery Post-Compromise

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the NUKESPED (zlrenu8.exe) implant performing post-compromise reconnaissance. This rule monitors for registry enumeration and modification, as well as the spawning of common system discovery processes (e.g., net.exe, tasklist.exe, systeminfo.exe) and the querying of specific registry keys related to OS version and computer identification.