ryan o riordan
@riordz0 followers7 downloads1 copy2 likes61 views
2 detections
Filters
Last updated
All Time
Detection languages
2
Categories
2
1
Platforms
2
MITRE Techniques
1
1
1
1
This detection identifies suspicious use of the Windows RunMRU registry key — typically used by Explorer to store command history — to execute .msi installer files. It specifically flags cases where a registry value under the RunMRU key contains a reference to a .msi file, which can indicate abuse by malware droppers such as LegionLoader.
This detection monitors the execution of 7zG.exe—the 7-Zip GUI executable—specifically when launched from the Traiolx Custom Utils or Kilo Verfair Tools directory under the user’s Roaming profile (\\AppData\\Roaming\\Traiolx Custom Utils). It identifies suspicious command-line activity where 7zG.exe is used to decrypt or extract a file named drata.dat, used to load second payload.