Phantom Stealer Persistence via Registry Run Key or Startup Folder from explorer.exe

Ibrahim Saud@tektrix

•updated Jun 24, 2026•3•0•6

This rule detects attempts to establish persistence by modifying Registry Run keys or creating files in Startup folders, specifically when the initiating process is 'explorer.exe'. This behavior is often associated with malware injecting into explorer.exe to maintain persistence.