AutoRun 'goopdate' registry persistence launching Sang.exe/defender.exe
This rule detects the creation or modification of Registry values within the Windows 'Run' keys that contain the specific value name 'goopdate' and associated data containing the string 'work'. This pattern is indicative of a persistence mechanism used by specific threats to ensure their components, often disguised or related to malicious executable payloads, are launched automatically upon user logon.
Microsoft Sentinel (KQL)
