Persistence Via Hhctrl.ocx Registry Modification
Detects when an attacker modifies the registry value associated with the 'hhctrl.ocx' COM object to point to a custom binary. This technique can be used for persistence, as 'hhctrl.ocx' is a legitimate Microsoft HTML Help ActiveX control, and hijacking its registration can lead to arbitrary code execution.
Sigma
