SUSP Obfuscated RunKey RegEx Inserted Chars
This rule detects obfuscation of the Windows Registry Run key paths (SOFTWARE\Microsoft\Windows\CurrentVersion\Run) through the insertion of arbitrary non-alphanumeric characters. This is a common evasion technique used to bypass simple string-based detections for persistent autostart registry entries.
YARA
