FlowCloud Malware Registry Markers

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•27

Detects specific registry markers associated with the FlowCloud malware, which is known to be used by the threat group TA410. The rule identifies unique registry paths where FlowCloud stores its configuration and drivers for its keylogger components.