10FXRAT Persistence via WinDiagTrack Registry Run Key
Detects the creation or modification of the 'WinDiagTrack' registry value within the Windows Run key, a known persistence mechanism used by the 10FXRAT malware. This rule specifically looks for actions that create or set registry values in 'Software\Microsoft\Windows\CurrentVersion\Run' with the name 'WinDiagTrack'.
Microsoft Sentinel (KQL)
