HEAVYGRAM Persistence via Run Key (RuntimeSSH.exe / winappx.exe)

Ibrahim Saud@tektrix

•updated 22 days ago•0•0•1

This rule detects modifications to the Windows 'Run' registry key intended to achieve persistence by launching potentially malicious executables named 'RuntimeSSH.exe' or 'winappx.exe'. Attackers often use these paths to ensure that their malicious code executes automatically upon user login.