Cryptojacking - WinSysCache Registry Persistence (T1547.001)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•7

Detects the creation of the WinSysCache registry run key designed to launch the RuntimeHost.exe component on startup, often associated with cryptojacking campaigns.