Fake Windows 11 Malvertising Installer and TIP Persistence
This rule detects the presence of a fake Windows 11 malvertising installer, specifically 'ms-update32.exe', which is known to be distributed via malicious advertisements. It correlates network connections to suspicious domains (including lookalike domains and GitHub hosting) with process execution from user-writeable paths or the presence of 'LunarApplication' artifacts, and registry modifications to the 'TIP\AggregateResults' key, indicating persistence. The rule requires at least two independent signals (registry write plus one or more supporting signals) within a 30-minute pivot window to reduce false positives.
Microsoft Sentinel (KQL)
