Registry Run Key Modification for Persistence with Scripting Tools

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•3

Detects modifications to common Windows Registry Run keys (Run, RunOnce, RunServices, RunServicesOnce) that include specific keywords ('ManageEngine', 'SystemOptimizer') and reference scripting tools ('wscript', 'cscript', 'powershell', 'cmd') in the RegistryValueData. This pattern is often used by adversaries to establish persistence on a system by ensuring their malicious scripts or commands are executed upon user login or system startup.