Potential Persistence Via CHM Helper DLL
This rule detects attempts to establish persistence by modifying the 'HtmlHelp Author' registry key. Attackers can leverage this mechanism to execute malicious code when HTML Help files are accessed, as the 'Location' value under 'Software\Microsoft\HtmlHelp Author' or 'Software\WOW6432Node\Microsoft\HtmlHelp Author' can be manipulated to point to a malicious DLL.
Sigma
