Suspicious AppInit DLL Persistence from User-Writable Directory
Detects AppInit DLL registry modifications referencing DLLs located in user-writable directories (such as AppData, Temp, Users\Public, or Downloads), which may indicate adversary persistence or process injection configuration.
Microsoft Sentinel (KQL)
