SOP-26: Scheduled Task & Registry Run Key Persistence Response

SOC analyst playbook for detecting and responding to attacker persistence via scheduled tasks and registry run keys. Event ID 4698/4702, schtasks.exe, HKCU Run keys, DeviceRegistryEvents. KQL for Sentinel, SPL for Splunk.