Suspicious Registry Reconnaissance and Persistence via Scheduled Tasks (LummaC2 TTPs)

Kaung Khant Ko@kaungkhantko

•updated Aug 26, 2025•6•8•130

Detects a combination of suspicious activities often associated with the LummaC2 stealer. This includes querying the 'Run' registry key for reconnaissance and creating a scheduled task for persistence, often named "Update" and set to run on logon.