Pay2Key Persistence via Registry Run Key Pointing to browser.exe in AppData

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

Detects the addition of a persistence mechanism by writing a registry value named 'browser' to the Windows Run key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run). The rule specifically looks for registry string values pointing to executables located within the user's AppData\Local directory, which is a common technique for establishing user-level persistence via masquerading as a web browser.