Detect Remote Access Software Persistence via Registry

This analytic detects when a known remote access software is added to common persistence locations on a device within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. The detection specifically looks for modifications to the 'Run' registry keys or 'ImagePath' values within service registry keys, which are common methods for establishing persistence. The rule leverages a lookup table containing known remote access tools such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer.