Install PneumaEX registry persistence

This is the exact same registry changes made by the GOP attackers to have their agent stay persistent throughout the attack. In this case, the staged PneumaEX will be persistent.
View Command

To view this TTPs command, you must be logged in with a professional or enterprise license.


Test this TTP

Download Operator (1.7.1)
Test this TTP using one of our Operator chains
APT38 Sony Hack


A Prelude portrayal of the 2014 hack on Sony attributed to APT38.