Persistence via Run Key with .NET Runtime Optimization Service Masquerading

nomit vyas@xoxo

•updated Jun 22, 2026•0•0•2

Detects the creation or modification of a registry run key that uses a name similar to '.NET Runtime Optimization Service' and points to a suspicious location within 'C:\ProgramData\'. This technique is often used by adversaries to establish persistence on a system by masquerading as legitimate software.