Phantom Bot Registry Run Key Persistence
Detects the Phantom Bot malware modifying the registry Run key with the value 'SystemUpdate' to establish persistence on Windows systems. The rule specifically looks for modifications to 'Software\Microsoft\Windows\CurrentVersion\Run' keys with the value name 'SystemUpdate'.
Microsoft Sentinel (KQL)
