Salat Stealer Run key and scheduled task persistence (Lightshot/Procmon/RuntimeB

ills3c Intel&Coffee@Ills3C

•updated yesterday•0•0•2

Detects the correlation of Registry Run key values for known utilities (Lightshot, Procmon, RuntimeBroker) pointing to paths in Program Files with a scheduled task creation of the same name on the same device within a 1-hour window.