Millenium RAT HKCU Run Key Persistence with System-Process Masquerade
Detects modifications to Windows 'Run' registry keys where the referenced executable path is located within the 'AppData\Roaming' directory. This pattern is commonly used by malware and unauthorized persistent agents to masquerade as legitimate system processes like 'svchost.exe', 'MsEdgeUpdate.exe', or 'rcsdriver.exe' to maintain persistence upon user logon.
Cortex XDR
