🎯 Modify Registry

The items that name it 3

• Phishing Abuses RMM Tools for Persistent Access
  writeup2026-09-29

  MSP360 and ScreenConnect modified registry locations associated with services, persistence, credential provider components, protocol handlers, and uninstall entries.

• Socket: Operation Muck and Load
  writeup2026-07-16

  Registry modifications observed in dynamic analysis of the payload chain.

• Socket: 11 Malicious NuGet Tools Pose as Game Cheats
  writeup2026-07-15

  Exit handler deletes DisableLogging and DisableMSI values under HKLM\Software\Policies\Microsoft\Windows\Installer