Run Once Task Execution via Registry

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•13

This rule detects the execution of 'runonce.exe' with specific command-line arguments, indicating the execution of a Run Once task as configured in the registry. This is a common method for persistence and defense evasion on Windows systems.