DeviceSync.exe from AppData persisting via HKCU Run key and logon schtask
Detects processes running from the AppData directory that attempt persistence by simultaneously creating a Registry Run key (reg.exe) and a scheduled task (schtasks.exe) within a 10-minute window.
Microsoft Sentinel (KQL)
