Suspicious NVIDIA Themed Registry Persistence
Detects the creation of Run or RunOnce registry keys being set with a specific "Update Drivers NVIDEO_" naming pattern. This behavior is indicative of a fileless .NET loader associated with a recent malspam campaign using masqueraded registry values to maintain stealthy persistence.
Sigma
