Ousaban Persistence via 'Financeiro' Registry Run Key
Detects the creation or modification of a specific registry Run key entry named 'Financeiro' in the Windows 'CurrentVersion\Run' hive. Such registry keys are a common technique used by malware or unauthorized scripts to establish persistence, ensuring code execution upon user logon.
Microsoft Sentinel (KQL)
