Persistence via Registry Run Keys

Ankit Mehta@Secvyn

•updated Jun 17, 2026•0•0•6

This rule detects attempts to establish persistence by modifying specific registry keys known to be used for auto-starting applications or malicious code. It specifically monitors for changes to 'AppInit_DLLs', 'LSAProviders', 'SecurityProviders', and 'WinlogonNotifyPackages' within Security Event ID 4657 (A registry value was modified).