Persistence via 'Canon Configuration Reader'/'Stardock DeElevation Tool' Run key
Detects the creation of Windows Registry Run keys with names mimicking known applications (e.g., 'Canon Configuration Reader' or 'Stardock DeElevation Tool'). These naming patterns are highly suspicious and indicative of attempts to achieve persistence or perform defense evasion via registry-based autostart execution.
Sigma
