Narrator's Feedback-Hub Persistence
This rule detects attempts to establish persistence or escalate privileges by abusing the Windows 10 Narrator's Feedback-Hub. Specifically, it looks for the deletion of the 'DelegateExecute' value or modification of the '(Default)' value within a specific registry key associated with the Feedback-Hub application. This technique can be used by an attacker to inject a malicious payload that will execute when the Narrator's Feedback-Hub is launched.
Sigma
