Frequent Registry Modification Activity

Shadows VMB@Vemorian_Mort

•updated Jul 15, 2026•2•0•6

This rule identifies processes performing a high volume of registry modifications by tracking unique registry key and value sets associated with user and process context. This behavioral pattern is often used to detect persistence mechanisms, configuration changes, or mass registry manipulation.