300-220 CBRTHD: Conducting Threat Hunting and Defending using Cisco Technologies for Cybersecurity

A security analyst needs to create a SIEM signature that detects malware modifying registry keys to establish persistence, ensuring the malware runs whenever a user signs in to Windows. The focus must be on specific registry changes linked to this persistence mechanism.

Which registry modification must the security analyst target?