Codex - Registry Encoded Payload Persistence (T1547.001)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•1•0•4

Detects Codex writing extremely large, encoded script blocks directly into HKCU registry values to achieve fileless reboot persistence.