SystemUpdate Registry Run Key Persistence
Detects the axois-utils phantom bot persistence mechanism attempting to modify the Windows Run registry key with the value 'SystemUpdate' pointing to a Node application. This rule specifically looks for registry set value events where the value name is 'SystemUpdate', the key path contains 'CurrentVersion\Run', and the data contains 'node', indicating an attempt to establish persistence by executing a Node.js application at user login.
Cortex XDR
