DarkMe Locked:// protocol handler and Run key persistence

Arnold Chan@slaz

•updated Sep 24, 2026•2•0•10

Detects potential persistence attempts via registry modifications involving rundll32.exe. The rule monitors for two patterns: registry keys associated with shell commands for specific file types triggering rundll32.exe, and registry 'Run' keys using a 'Locked' value name with a custom URI handler, often indicative of malware or suspicious persistence mechanisms.