Windows COM Hijacking Persistence Forumtroll
Detects Component Object Model (COM) hijacking used by the ForumTroll APT group for persistence. This rule identifies modifications to the registry where a malicious DLL is registered to be loaded by legitimate processes by overriding the CLSID for twinapi.dll in the HKEY_CURRENT_USER hive.
YARA-L
