CHOSEN BRICK persistence via HKCU Run key (SMQDService/winappx)
Detects the modification of Windows Registry Run keys that point to suspicious executable paths or known naming patterns associated with specific services (SMQDService and winappx) often utilized for persistence.
Microsoft Sentinel (KQL)
