HEAVYGRAM Registry Run Key Autorun Persistence via reg/regtro
Detects modifications to HKEY_CURRENT_USER Run keys associated with the HEAVYGRAM backdoor, which uses specific filenames and patterns to establish persistence via autorun registry entries.
Splunk (SPL)
