Malicious Registry Key Modification

Ankit Mehta@Secvyn

•updated Jun 17, 2026•0•0•3

This rule detects modifications to specific registry keys that are commonly used for persistence by malware. The rule looks for Event ID 4657 (A registry value was modified) and checks if the ObjectName corresponds to known malicious registry paths related to Run keys, RunOnce, or service configurations. This indicates an attempt to establish persistence or alter system behavior for malicious purposes.