All Detections

KNOTWEED-COM Registry Key Modified to Point to Color Profile Folder

Azure Sentinel@AzureSentinel
updated Jun 17, 2025013

'This query identifies modifications to COM registry keys to point to executable files in C:\Windows\System32\spool\drivers\color\'

Microsoft Sentinel (KQL)