Mistic Sideloading and Persistence Detection

Kaung Khant Ko@kaungkhantko

•updated Jun 25, 2026•0•0•3

This rule monitors for persistence mechanisms being established on Windows systems. Specifically, it tracks unauthorized modifications to the HKEY_CURRENT_USER Run registry key using 'reg.exe', the creation of scheduled tasks using 'schtasks.exe', and suspicious process spawning patterns where 'MpExtMs.exe' executes 'reg.exe' or 'schtasks.exe' to facilitate persistence.