Registry modification by unsigned OnyxC2 dropper process (Setup_File_92.118.3096.exe)
Detects registry key/value creation, modification, or deletion by the unsigned OnyxC2 dropper process (Setup_File_92.118.3096.exe) running from a Temp\Rar or Downloads path, consistent with OnyxC2 configuration/persistence storage.
Microsoft Sentinel (KQL)
