Registry Run Key Persistence with Conhost and Node.exe
Detects the creation or modification of a registry run key that establishes persistence by executing 'conhost' or 'node.exe' with '--headless' or '.cfg' arguments. This technique is often used by adversaries to maintain access to a system after a reboot or user login.
Microsoft Sentinel (KQL)
