Electron login-item persistence from AppData
This rule detects the creation of a Run key or login persistence entry by an Electron or Node.js process, where the persistent application is located within the AppData\Local directory. It specifically looks for registry modifications that establish persistence for executables in user-specific application data folders, often indicative of malware or unwanted applications.
Cortex XDR
