Skip to content

persist via Run registry key #1037

@mike-hunhoff

Description

@mike-hunhoff

match(set registry value) hits for a call that occurs XX calls before the persistence key is opened. The match(set registry value) that we want to hit is the next call after match(create or open registry key).

We may be able to mitigate this by adding call order matching to dynamic, e.g., we expect the hit order to be match(create or open registry key), match(set registry value).

trigger: https://www.virustotal.com/gui/file/e12846a368f22492bb6c6fce37a0db0ccf3abc204b24315f4619e20be33dfeac/behavior

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions