Suspicious User Shell Folders Registry Change through CommandLine (via process_creation)

This rule detects modifications to User Shell Folders registry values via reg.exe or PowerShell, which could indicate persistence attempts. Attackers may modify User Shell Folders registry values to point to hostile executables or scripts that will be executed during startup. This method is frequently used to maintain persistence on a compromised system by ensuring that hostile payloads are executed automatically.