Pay2Key Persistence via HKLM Run Key with browser.exe in GUID-Named AppData Dir
Detects the creation of a registry run key entry in HKLM that points to an executable named 'browser.exe' located within a user's AppData\Local directory, specifically matching a GUID-based subfolder structure. This behavior is indicative of malicious persistence mechanisms, where an adversary attempts to execute a masqueraded binary upon system startup.
Microsoft Sentinel (KQL)
