HEAVYGRAM/MicDriver Persistence via HKCU Run Registry Key

Arnold Chan@slaz

•updated Sep 16, 2026•0•0•2

This rule detects modifications to the Windows Registry 'Run' keys that point to specific, potentially suspicious executable paths located in 'C:\ProgramData\'. These paths are commonly associated with persistence mechanisms used by malware or unauthorized software to ensure execution at system startup.