Registry Persistence via Explorer Run Key in Suspicious Locations
Detects the creation or modification of a Registry Run key specifically for Windows Explorer, where the value points to suspicious locations such as the Recycle Bin, ProgramData, Temp directories, or Public/Default user profiles. This is a common technique used by adversaries to establish persistence on a system, ensuring their malicious code executes upon user login.
Sigma
