alexandre paquette
@kramtoux0 followers10 downloads9 copies2 likes289 views
2 detections
Filters
Last updated
All Time
Detection languages
2
Categories
1
1
Platforms
2
Products / Services
1
1
1
MITRE Techniques
1
1
1
1
1
This rule detects the creation of a registry run key (Run or RunOnce) that attempts to establish persistence by executing a DLL via regsvr32. It specifically looks for registry value data containing 'regsvr32' followed by a DLL path. The rule then correlates this registry event with a file creation event for the same DLL on the same device within a specified timeframe, indicating a potential persistence mechanism where a malicious DLL is dropped and then configured to run at startup.
DEVMAN Ransomware Detection