Suspicious Run key persistence via disguised entry names (Mustang Panda)

Duo Tech@duotech

•updated Jul 10, 2026•17•0•32

This rule detects modifications or creation of registry values within the Windows 'Run' keys that specifically match known malicious persistence mechanism identifiers, such as 'MediumNetMonIt' or 'ZohoUsingUpdataAnyssAll_RunOnece'. These registry keys are frequently used by attackers to ensure malicious code executes automatically upon system boot or user logon.