KGB RAT Run policy 'Loader' value plus Startup folder .url persistence

ills3c Intel&Coffee@Ills3C

•updated 4 days ago•0•0•4

Correlates the modification of the Explorer Policies Run registry key (specifically the 'Loader' value) with the creation or modification of a .url shortcut file in the user Startup folder on the same device within a 1-hour window, using the same initiating process.