Skip to content
Threat Feed
Subscribe

Tag

Encoded-Executable

2 briefs RSS
medium advisory

Encoded Executable Stored in the Registry

This rule detects registry modifications used to hide encoded portable executables, indicating a defense evasion technique where adversaries avoid storing malicious content directly on disk by writing encoded executables to the Windows Registry.

Windows defense-evasion registry-modification encoded-executable
2r 3t 1i
high advisory

Detection of Hidden Encoded Executables via Registry Modification

Attackers can hide and execute malicious code by storing it in encoded form within the Windows Registry and then executing it, evading traditional file-based detection mechanisms.

Windows defense-evasion registry-modification encoded-executable
3r 3t