General Info

https://blogs.technet.microsoft.com/askds/2010/03/23/group-policy-script-processing-behavior/
http://www.hexacorn.com/blog/2017/01/07/beyond-good-ol-run-key-part-52/
$data += [PSObject] @{Path='HKLM:\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\*\'; Entries='*'}
$data += [PSObject] @{Path='HKCU:\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\'; Entries='*'}
https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Krotten-N/detailed-analysis.aspx
https://www.cylance.com/threat-spotlight-eyepyramid-malware