Registry Run Key Persistence via Headless Conhost
This rule detects attempts to establish persistence by modifying the Windows Registry 'Run' key to execute 'conhost.exe' in headless mode. This technique is often used by adversaries to maintain access and execute malicious payloads upon user login, while attempting to hide the execution by using a legitimate Windows binary in a less common mode.
CQL
