Persistence via Registry Run Key or Startup Folder
Detects persistence mechanisms involving the modification or creation of Windows Registry Run keys or the placement of executables/shortcuts in the Windows Startup directory. The rule specifically targets binaries located in user-writable directories (Temp, AppData, Downloads) that are either unsigned or lack a signature from trusted publishers, while excluding known legitimate system and third-party application paths.
Microsoft Sentinel (KQL)
