Suspicious Modify User Shell Folders Startup Value (via registry_set)

This rule detects modification of the User Shell Folders registry values for Startup or Common Startup which could indicate persistence attempts. Attackers may modify User Shell Folders registry keys to point to hostile executables or scripts that will be executed during startup. This method is frequently used to maintain persistence on a compromised system by ensuring that the hostile payload is executed automatically.