Yuta/Glove Stealer Run Key or Startup Folder Persistence to AppData/Temp
Detects evidence of Yuta/Glove Stealer malware establishing persistence. The rule monitors for unauthorized registry modifications to Windows Run keys pointing to suspicious paths (AppData, Temp) or specific files ('winupdate.exe'), and the creation of files within the Windows Startup folder using specific naming conventions such as 'WindowsDefenderAgent' or 'winupdate'.
YARA-L
