Windows registry artifactREvil IOCs
REvil/Kaseya Ransomware attack from July 2021
- Threat Hunting
- 1 key
SOFTWARE
Registry keys
1 key that RECmd reads for this artifact
SOFTWARErecursiveWow6432Node\BlackLivesMatterREvil/Kaseya Ransomware attack from July 2021
References
3 links
- community.sophos.com/b/security-blog/posts/active-ransomware-attack-on-kaseya-customers(opens in new tab)
- huntress.com/blog/rapid-response-kaseya-vsa-mass-msp-ransomware-incident(opens in new tab)
- symantec-enterprise-blogs.security.com/blogs/threat-intelligence/kaseya-ransomware-supply-chain(opens in new tab)
Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)