Axios Supply Chain Attack - Registry Run Key Persistence via MicrosoftUpdate and system.bat
Detects the creation or modification of a registry run key in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run with the name 'MicrosoftUpdate' and data containing 'system.bat'. This is a common technique used by adversaries to establish persistence, ensuring their malicious code executes upon user login.
Microsoft Sentinel (KQL)
