Suspicious VPN Executable Persistence
Detects the creation of registry Run or RunOnce keys that point to executables mimicking popular VPN clients. This technique is used by threat actors like Storm-2561 to establish persistence for their malicious payloads, which are often fake VPN clients designed for credential theft. The rule specifically looks for these executables being run from non-standard locations, such as user profiles, instead of the legitimate 'Program Files' directory.
Sigma
