System crash behavior manipulation - WMImplant (registry)

Detects scenarios where an attacker abuses the Windows "system failure and recovery" capacities (CrashControl) to store information or to establish persistence.