Cryptojacking via ScreenConnect - WinSysCache Registry

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•10

Detects the creation of the 'WinSysCache' registry run key to launch 'RuntimeHost.exe', which is indicative of cryptojacking activity often associated with abuse of ScreenConnect.