QEMU Persistence via Registry Run Key or Defender Disable (T1112)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects multiple suspicious registry modifications typically associated with threat actor activity. It identifies potential persistence via HKLM Run keys using QEMU-related strings, attempts to tamper with Windows Defender security settings (DisableAntiSpyware/DisableRealtimeMonitoring), and the enabling of WDigest plaintext credentials, which facilitates credential dumping.