MicrosoftSystem64 Malware Persistence and Execution Activity

Georgios Maragos@Gmarak

•updated Jun 3, 2026•4•0•18

Detects execution and persistence mechanisms associated with the MicrosoftSystem64 payload observed in malicious npm supply-chain campaigns. The rule focuses on stable post-compromise artifacts including execution, scheduled tasks, services, registry Run keys, and startup folder persistence.