Registry Run Key Modification for Persistence

Ankit Mehta@Secvyn

•updated Jun 17, 2026•0•0•5

This rule detects modifications to Windows Registry Run keys (Run, RunOnce, RunOnceEx, Policies\Run) where the new value contains common scripting interpreters like PowerShell, cmd, cscript, or wscript, and the path is not within the System32 directory. This behavior is indicative of an adversary attempting to establish persistence by ensuring their malicious script or command executes upon user login.