Registry Run Key Modification for Persistence with Scripting Tools

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•4

Detects modifications to common Windows Registry Run keys (Run, RunOnce, RunServices, RunServicesOnce) that include specific keywords ('ManageEngine', 'SystemOptimizer') and attempt to execute scripting tools (wscript, cscript, powershell, cmd). This pattern is often used by adversaries to establish persistence on a system.