Sigma rule: FlowCloud Registry Markers

Rule

Title

FlowCloud Registry Markers

Status

test

Level

critical

Author

NVISO

Date

2020-06-09

Modified

2024-03-20

File

rules-emerging-threats/2020/Malware/FlowCloud/registry_event_malware_flowcloud_markers.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects FlowCloud malware registry markers from threat group TA410.
The malware stores its configuration in the registry alongside drivers utilized by the malware's keylogger components.

Log source

product

windows

category

registry_event

Detection

selection:
    TargetObject|contains:
        - '\HARDWARE\{2DB80286-1784-48b5-A751-B6ED1F490303}'
        - '\HARDWARE\{804423C2-F490-4ac3-BFA5-13DEDE63A71A}'
        - '\HARDWARE\{A5124AF5-DF23-49bf-B0ED-A18ED3DEA027}'
        - '\SYSTEM\Setup\PrintResponsor\'
condition: selection

False positives (as the rule lists them)

• Unlikely

Tags

• attack.persistence
• attack.defense-impairment
• attack.t1112
• detection.emerging-threats

MITRE ATT&CK ids this rule names

• T1112

References

• https://www.proofpoint.com/us/blog/threat-insight/ta410-group-behind-lookback-attacks-against-us-utilities-sector-returns-new

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2020/Malware/FlowCloud/registry_event_malware_flowcloud_markers.yml