Suspicious Registry Keys

Description

ZLoader was delivered in a campaign in late summer 2021 using malvertising to download malicious .msi files onto affected machines. This campaign was originally tweeted by @MsftSecIntel on Twitter. In this campaign, the malicious .msi files create registry keys that use that attacker-created comapny names.

Query · kql

DeviceRegistryEvents
| where RegistryValueData in('Flyintellect Inc.', 'Datalyst ou')
Raw source Suspicious Registry Keys · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: fab0fc37-d74a-43b6-9f13-d517b9cbcb14
name: Suspicious Registry Keys
description: |
  ZLoader was delivered in a campaign in late summer 2021 using malvertising to download malicious .msi files onto affected machines. This campaign was originally tweeted by @MsftSecIntel on Twitter.
  In this campaign, the malicious .msi files create registry keys that use that attacker-created comapny names.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceRegistryEvents
tactics:
- Persistence
query: |
  DeviceRegistryEvents
  | where RegistryValueData in('Flyintellect Inc.', 'Datalyst ou')

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.