TAG-195 Registry Run Key Persistence via Staged OCX Payload
Detects the creation or modification of Windows Registry Run keys that point to OCX (ActiveX Control) files located within user-writable AppData directories. This behavior is associated with the persistence mechanisms of various malware families, including TinyEgg, ChonkyChicken, and ChromEggscalator, which often utilize the 'WinComCtl' value name to maintain execution across system reboots.
Microsoft Sentinel (KQL)
