PlugX G Data Registry Persistence
Detects post-reboot persistence mechanism established by the Mustang Panda PlugX variant, utilizing a 'G Data' Run key and a suspicious staging path pointing to 'Avk.exe'. This rule specifically looks for registry key creations or value sets in the Run key where the value name is 'G Data' or the value data contains 'GData\Avk.exe'.
Microsoft Sentinel (KQL)
