Millenium RAT WH_KEYBOARD_LL Keylogger: Unsigned AppData Process + Run Key
Detects instances where a process originating from common suspicious directories (AppData Roaming, AppData Local, or Temp) modifies a Windows Run registry key, which is a common persistence technique used to ensure code execution upon user logon.
CQL
