Woodgnat Run Key Persistence Disguised as AnyDesk, Splashtop, or Comms
Detects the creation or modification of HKCU Registry Run keys where the value name mimics legitimate remote access software (AnyDesk, Splashtop, or Comms). This behavior is associated with the Woodgnat (KongTuke) threat actor to establish persistence by masking malicious autostart entries as common administrative tools.
Microsoft Sentinel (KQL)
