Vidar Turb00 Svchost Brn_Agent Persistence
Detects modifications to the Windows Svchost registry key adding 'Brn_Agent', a technique used by Vidar to load its malicious DLL via svchost.exe. This specific registry modification indicates an attempt to establish persistence.
Microsoft Sentinel (KQL)
