HoneyMyte CoolClient Persistence Activity
Detects persistence mechanisms used by the HoneyMyte APT group's CoolClient backdoor. The rule looks for the creation of a specific scheduled task ('ComboxResetTask') or the modification of a registry run key to include the 'work' parameter, which are characteristic of the backdoor's 'passuac' and 'install' routines.
Microsoft Sentinel (KQL)
