FormBook RAT Persistence via Disguised Run Key
Detects the FormBook RAT persistence mechanism where it copies itself to a disguised location (%APPDATA%\Roaming\word\word.exe) and creates a registry run key named 'svchost.exe' to ensure execution at user login. The rule correlates the file creation and registry modification events on the same device within a short time window.
Microsoft Sentinel (KQL)
