Registry Run/RunOnce Persistence Write - T1547.001
Detects the modification or creation of registry values within the Windows Run or RunOnce keys. These keys are commonly abused by adversaries for persistence to ensure that malicious code or scripts execute automatically when a user logs in. The rule includes exclusions for common legitimate installers and signed applications from well-known publishers to reduce noise.
SentinelOne
