EtherRAT Headless Persistence

Bryant Smith@flowstate

•updated Mar 30, 2026•1•0•48

Detects registry modifications to the Run key via reg.exe that include the conhost.exe executable with the undocumented --headless parameter. This technique is used by EtherRAT for persistent, stealthy execution of its Node.js payloads.