STAC4924 – TerminalFix / Lorem Ipsum Loader Masquerading Persistence
Detects the creation of persistence mechanisms through both Registry Run keys and Scheduled Tasks within a one-hour window, specifically targeting names indicative of masquerading as legitimate update or helper components.
Microsoft Sentinel (KQL)

