Pandemic Registry Key

Title: Pandemic Registry Key
Status: test
Description:Detects Pandemic Windows Implant
References:
  -https://wikileaks.org/vault7/#Pandemic
  -https://twitter.com/MalwareJake/status/870349480356454401
Author: Florian Roth (Nextron Systems)
Date: 2017-06-01
modified:2022-10-09
Tags:

• -'attack.command-and-control'
• -'attack.t1105'

Logsource:

• category: registry_event
• product: windows

Detection:
  selection:
    TargetObject|contains: '\SYSTEM\CurrentControlSet\services\null\Instance'
  condition:selection
Falsepositives:
  -Unknown
Level: critical