Potential Ke3chang/TidePool Malware Registry Activity

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•23

This rule detects registry modifications associated with the Ke3chang/TidePool malware families. Specifically, it looks for command-line arguments used to modify the 'Check_Associations', 'DisableFirstRunCustomize', and 'IEHarden' registry keys. These modifications are known to be unique to these malware families and were observed in campaigns in 2019 and 2020.