New Detection: Specific hijack locations called out in public blogs/articles/etc

[joeavanzato]

There is a constant stream of operators calling out common program DLL hijacks - I want to build a detection focused on hunting these common hijack paths to help analysts detect a potential abuse.

For example - https://www.mandiant.com/resources/blog/malware-persistence-windows-registry