Persistence through a Run key
Values under the Run and RunOnce keys start a program at every logon. A post-exploitation framework added one on two machines, once for all users and once for the current user, so that its agent starts again after a reboot. Installed software writes to the same keys: the clean Windows 10 client has entries from Dropbox, Spotify, Edge, Google Drive, KeePass and others. Find the two entries the attacker added.
Hint 1
TargetObject tells you where the value was written; Details tells you what will run; Image tells you which program wrote it.
Hint 2
Not every key with Run in its path is a Run key: look for RunTime and RunLogonScriptSync in the data.
The rule runs in this browser; it is saved here so you can come back to it.
Events
9,693 events. Search filters the table; it does not affect the result.