GoGRPC persistence via fake Realtek HD Audio Run key
Detects creation of a Registry Run key value named 'Realtek HD Audio' under HKCU\Software\Microsoft\Windows\CurrentVersion\Run pointing to a GoGRPC payload staged as %APPDATA%\sekv*.exe, used for persistence after a Quick Assist vishing intrusion.
Microsoft Sentinel (KQL)
