Persistence via Run/RunOnce Registry Key Modification

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•0

Detects the creation or modification of Windows Registry Run keys, which are a common mechanism for achieving persistence by executing programs automatically upon user logon or system boot. The rule excludes common, legitimate software update or installation processes that frequently interact with these keys.