High Volume Registry Modifications to Run or Services Keys

Ankit Mehta@Secvyn

•updated Jun 12, 2026•0•0•2

This rule detects a high volume (10 or more within an hour) of registry modifications to keys related to 'Run' or 'Services'. Such modifications can indicate attempts to establish persistence, alter system behavior, or install/modify services for malicious purposes. Event ID 4657 specifically logs a registry value being modified.