Registry Run Key to Hidden Payload (T1547.001)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•2

Identifies Run/RunOnce registry modifications pointing to binaries located in anomalous, hidden folders, specifically within the AppData\LocalLow directory.