Toy Ghouls matrix-bird-agent SealedConfig registry write & config.toml deletion

Arnold Chan@slaz

•updated 26 days ago•1•0•3

Detects the modification or creation of the 'SealedConfig' value within the 'Software\synapse\Config' registry key, correlated with the deletion of a 'config.toml' file on the same device. This pattern may indicate an adversary tampering with Synapse software configuration or attempting to remove audit/configuration trails.