Potential NetWire RAT Registry Key Creation

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•25

This rule detects the creation of registry keys associated with NetWire RAT. Specifically, it looks for the creation of a registry key containing '\software\NetWire' in its path, which is a known location where NetWire RAT stores its configuration information.