Known Nylon Typhoon Registry modifications patterns

This query identifies instances where malware intentionally configures the browser settings for its use by modifying the following registry entries by Nylon Typhoon threat actor.

Detection logic

Detection requirements

Platform: Windows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
Log source product: microsoftthreatprotection securityevents windowsforwardedevents windowssecurityevents
Log source service: deviceregistryevents securityevent securityevents windowsevent

Detection rules

Known Nylon Typhoon Registry modifications patterns

Detection logic

Detection requirements

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules