C2Agent persistence: Windows-dir binary creating multiple autostart mechanisms

ills3c Intel&Coffee@Ills3C

•updated yesterday•8•0•9

Detects an executable running from the C:\Windows\ directory (excluding known benign applications) that establishes two or more distinct persistence mechanisms within a short timeframe, such as scheduled tasks, registry run keys, or startup folder shortcuts.