Skip to content
.ca
Home
Posts
Engagements
Recaps
IOCs
Detections
About
Search posts and IOCs
sign in
Loading…
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\monitoringservice · registry key · cyfar.ca
indicator
registry_key
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\monitoringservice
copy defanged
copy refanged (live)
First seen
2026-05-13
Last seen
2026-05-14
Sightings
1
Posts referencing this indicator
Through the Lens of MDR: Analysis of KongTuke’s ClickFix Abuse of Compromised WordPress Sites
Trend Micro
Registry Run key created for modeloRAT persistence.
2026-05-13
