SystemBC Persistence — Run Key/Scheduled Task/Service Within 60s of Writable-Path Exec
Detects the establishment of persistence via Registry Run keys, Scheduled Tasks, or Windows Services, where the executed file or binary path is located in suspicious directories such as AppData, Temp, or ProgramData. This indicates potentially malicious code staged in temporary or user-writable locations to maintain access.
CQL
