CryptoClipper HKCU\Software\Clipper wallet address registry values (KGB RAT)
Detects potential cryptocurrency clipper malware by monitoring the staging of multiple attacker wallet addresses (BTC, ETH, TRC) under the HKCU\Software\Clipper registry path by a non-system process.
Microsoft Sentinel (KQL)
