HEAVYGRAM persistence via reg add to Run autorun key
Detects HEAVYGRAM/CRUDEEXCLUDE persistence via Run-key registry writes or reg.exe command-line adds, scoped to payloads staged in AppData/ProgramData/Temp/Public/Downloads and excluding legitimate Program Files/System32 targets to reduce false positives from normal software autorun entries.
Microsoft Sentinel (KQL)
