All Detections

CoolClient rootkit RNG registry hive stealth configuration

avatar
Duo Tech@duotech
updated Aug 14, 2026002

Detects modification of the CoolClient rootkit's stealth-configuration registry value (Wid_H1deF5Dirs) under the \SYSTEM\RNG hive.

Microsoft Sentinel (KQL)