Mustang Panda Activity: DLL Copy and Registry Run Key Persistence
This rule detects specific command-line executions associated with Mustang Panda's activity, particularly targeting the Australian government, as reported by Lab52. The rule looks for two distinct patterns: the copying of 'SolidPDFCreator.dll' to a specific public user directory, and the modification of the Windows Registry 'Run' key to establish persistence for 'SolidPDF' using the same directory. These actions indicate an attempt to install and persist malicious software.
Sigma
