Kimsuky NUKESPED zlrenu8.exe System Discovery via Registry and Systeminfo

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects the NUKESPED backdoor (zlrenu8.exe) performing post-compromise system information discovery. The rule monitors for registry key enumeration within HKLM/HKCU SOFTWARE hives and the execution of the systeminfo.exe utility.