Rehabilitating Registry Tradecraft with RegRestoreKey:

https://www.preludesecurity.com/blog/rehabilitating-registry-tradecraft-with-regrestorekey

#infosec #windows #cybersecurity #edr #callback