BraZetsu Malware Framework - Backdoor Persistence Established Through Windows Run Key
This hunting query identifies potential persistence mechanisms established through the Windows Run registry key, where a registry value named "MonitorSystem" is created or modified and configured to execute a Python script (.py) at user logon. Such behavior may indicate an attempt by malware or unauthorized software to maintain persistence across reboots by automatically launching a Python-based payload whenever the user signs in. While reporting has specifically observed the filename agenteV2_historico_detect.py, the detection intentionally searches for the broader .py extension to improve coverage against variations in script naming.
Microsoft Sentinel (KQL)
