Registry Run Key Persistence via MonitoringService
This rule detects the creation of a registry key named 'MonitoringService' under 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'. This registry key is commonly used by adversaries to establish persistence, ensuring that a malicious program or script executes automatically each time a user logs on to the system.
Microsoft Sentinel (KQL)
