NvmProtocal Run Key Persistence via reg.exe
Detects the use of reg.exe to add persistence via the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key. This rule specifically looks for the addition of 'NvmProtocal', 'protocal.cjs', or 'NodePackages' which are associated with a backdoor.
Microsoft Sentinel (KQL)
