reg.exe Persistence via Run/RunOnce Keys to Suspicious Paths

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•0

Detects the use of reg.exe to modify Windows Registry Run or RunOnce keys pointing to executable files located in suspicious, user-writable directories such as AppData, Temp, or ProgramData, which is a common persistence technique.