New RUN Key Pointing to Suspicious Folder
This rule detects the creation or modification of Windows Registry 'Run' keys that point to executable files located in suspicious directories. Adversaries often use 'Run' keys for persistence, ensuring their malicious code executes automatically when a user logs in. By monitoring these keys for entries pointing to common temporary, user-specific, or system-related folders that are not typically used for legitimate application startup, the rule aims to identify potential malicious persistence mechanisms. The rule includes filters for known legitimate activities, such as Windows Update and Spotify, to reduce false positives.
Sigma
