Registry Run Key Persistence via Randomized Value Name XNNNMHJAZNCNHGIKJDW
Detects the creation of a registry run key with a specific randomized value name, often used by malware to maintain persistence on a Windows system. The rule monitors the Run key locations for indicators of automated execution at login.
Microsoft Sentinel (KQL)
