MuddyWater PatchAgent - Run Key Persistence via svc_upd.exe
Detects the PatchAgent persistence mechanism used by MuddyWater-linked PatchAgent loader chain: a copy of the loader written to %APPDATA%\Microsoft\PatchAgent\svc_upd.exe combined with a HKCU...\CurrentVersion\Run\PatchAgent registry value pointing to that binary with -p/-k arguments. This specific path and value name combination is distinctive to the campaign's persistence stage.
YARA-L
