Registry Run Key Persistence with Randomized Names

Ankit Mehta@Secvyn

•updated Jun 23, 2026•0•0•1

Detects the creation or modification of registry run keys that establish persistence by executing programs from user-specific application data folders (AppData\Roaming or %APPDATA%) with randomized names. This rule specifically excludes legitimate Windows and Program Files paths to reduce false positives.