Electronnodejs Persistence Via Run Key In Appdata
Detects attempts by Electron or Node.js applications to establish persistence by creating or modifying Run or RunOnce registry keys. The rule specifically looks for applications located within the AppData\Local directory, which is a common technique for malware or unwanted applications to maintain execution across system reboots. This rule leverages UDM for principal and target context to aid in correlation.
YARA-L
