Turla Kazuar v3 Registry Run Key Persistence
Detects the registry-based persistence mechanism used by Turla's Kazuar v3 loader. The rule specifically looks for the creation or modification of a registry entry in 'HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' with the value name 'Hewlett Packard Drivers' and the data containing 'hpbprndi.exe'. This combination indicates the malware's attempt to masquerade as a legitimate HP printer driver for persistence across system reboots.
Sigma
