Drun Backdoor Registry Enumeration of HKLM\SOFTWARE
Detects when 'drun.exe' queries registry keys or values within the HKEY_LOCAL_MACHINE\SOFTWARE hive. This activity could indicate an attempt by the 'drun.exe' process to discover system configuration or installed software information.
Microsoft Sentinel (KQL)
