KGB RAT registry tampering: ShowSuerHidden and SEE_MASK_NOZONECHECKS on same hos
Detects when a process modifies the Windows Registry to disable zone checks (SEE_MASK_NOZONECHECKS) in the Environment key and alters settings to show hidden files (ShowSuerHidden) within 30 minutes on the same device. This behavior is commonly associated with malware attempting to execute downloaded payloads without security prompts while concealing artifacts.
Microsoft Sentinel (KQL)
