Star Blizzard RedFlick: CosmicPulse CPL downloader writes AES key to .mollis registry key
Detects the modification or creation of the registry key '.mollis' within Software\Classes, which is used by the Star Blizzard (RedFlick) CPL downloader to store an encrypted AES key. This activity is performed by common Windows processes such as control.exe, rundll32.exe, or regsvr32.exe.
Microsoft Sentinel (KQL)
