All Detections

YiBackdoor Persistence Via Regsvr32 Run Key

avatar
Tim Peck@timpeck
updated Sep 24, 202510132

Detects the YiBackdoor persistence technique where a DLL is written to disk and subsequently configured to be executed by regsvr32.exe via a registry Run key.

YARA-L