Potential Persistence Via App Paths Default Property
Detects changes to the "Default" property for keys located in the \Software\Microsoft\Windows\CurrentVersion\App Paths\ registry. This might be used as a method of persistence. The entries found under App Paths are used primarily to map an application's executable file name to that file's fully qualified path and to prepend information to the PATH environment variable on a per-application, per-process basis.
Sigma
