Registry Persistence via Recycle Bin CLSID Modification

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•13

Detects attempts to establish persistence by modifying registry keys associated with the Recycle Bin. This technique leverages the Recycle Bin's CLSID to execute arbitrary commands, often for privilege escalation or maintaining access.