PUP Fangs - HKCU Run Key Adware Persistence
Detects potentially unwanted programs (PUPs) establishing reboot persistence by writing their extracted, secondary malware stage into the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key. This rule specifically looks for registry modifications where the value data points to an executable within AppData (Local or Roaming) and the initiating process is an installer, updater, or setup executable.
Microsoft Sentinel (KQL)
