UNC1549 Run key persistence via fake OneDrive registry values
Detects persistence attempts via Windows Registry Run keys, specifically targeting indicators associated with UNC1549. The rule monitors Sysmon Event ID 13 for modifications to 'CurrentVersion\Run' keys, flagging entries containing specific filenames like 'FileCoAuth.exe' or 'secur32.dll', as well as generic write operations to AppData or Temp directories.
Splunk (SPL)
