Millenium RAT persistence via MsEdgeUpdate Run key pointing to APPDATA svchost.exe
Detects the creation or modification of a registry run key named 'MsEdgeUpdate' that points to an executable named 'svchost.exe' located within an 'AppData' directory. This behavior is highly suspicious as it mimics a legitimate Microsoft Edge update process to achieve persistence while running an arbitrary executable from a user-writable path.
Microsoft Sentinel (KQL)
