Registry Run key persistence via cplsupport/wtass bird-agent backdoor

Arnold Chan@slaz

•updated Sep 4, 2026•0•0•4

This rule detects modifications to Windows Registry persistence keys (Run and RunOnce) associated with specific suspicious filenames ('cplsupport.exe', 'wtass.exe'), as well as modifications to specific Synapse agent configuration registry keys. These patterns are often associated with persistence mechanisms or unauthorized software configuration changes.