Ousaban Persistence via 'Financeiro' Registry Run Key

Duo Tech@duotech

•updated Jul 2, 2026•0•0•1

This rule detects modifications to Windows Registry Run keys, specifically looking for a registry value named 'Financeiro', which is a common persistence mechanism used to execute malicious programs automatically upon user logon.