STAC4713/GOLD ENCOUNTER QEMU Run Key Registry Persistence
Detects modifications to Windows Registry Run or RunOnce keys initiated by either a QEMU-based process (qemu-system) or the Windows Registry utility (reg.exe). The rule specifically targets instances where the registry value data points to common temporary directory paths, which is characteristic of the STAC4713/GOLD ENCOUNTER intrusion activity where QEMU-based virtualization is used to facilitate persistence.
YARA-L
