AstarionRAT - HKCU Run Key Persistence (T1547.001)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•2

Identifies AstarionRAT establishing persistence by writing itself into the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key, specifically looking for an executable in an AppData path, initiated by rundll32.exe.