Potential WerFault ReflectDebugger Registry Value Abuse

Title: Potential WerFault ReflectDebugger Registry Value Abuse
Status: test
Description:Detects potential WerFault "ReflectDebugger" registry value abuse for persistence.
References:
  -https://cocomelonc.github.io/malware/2022/11/02/malware-pers-18.html
  -https://www.hexacorn.com/blog/2018/08/31/beyond-good-ol-run-key-part-85/
Author: X__Junior
Date: 2023-05-18
modified:None
Tags:

• -'attack.stealth'
• -'attack.t1036.003'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection:
    TargetObject|endswith: '\Microsoft\Windows\Windows Error Reporting\Hangs\ReflectDebugger'
  condition:selection
Falsepositives:
  -Unknown
Level: high