ClickFix loader persistence via Registry Run key or Startup folder write
Detects persistence attempts by monitoring modifications to Windows 'Run' registry keys, the creation of executable files (.exe, .lnk) within the user's startup directory, or the use of common command-line utilities (reg.exe, powershell.exe) to modify these autostart persistence locations.
Splunk (SPL)
