New RUN Key Pointing to Suspicious Folder
This rule detects the creation or modification of Windows Registry Run keys that point to executable files located in suspicious folders. Adversaries often use Run keys for persistence, ensuring their malicious code executes automatically when a user logs in. The rule specifically looks for entries in common Run key paths (e.g., CurrentVersion\Run, Wow6432Node\Microsoft\Windows\CurrentVersion\Run, Policies\Explorer\Run) where the associated executable's path is within directories commonly used by malware or temporary files (e.g., PerfLogs, ProgramData, Windows\Temp, AppData\Local\Temp, Recycle.Bin, Users\Default, Users\Public, or user profile subdirectories like Favorites, Music, Documents). A specific exclusion is included for legitimate Windows update processes that might write to temporary folders via RunOnce keys.
YARA-L
