npm RAT csshost Registry Run Key Persistence (T1547.001)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•0

Detects the creation or modification of a registry run key value named 'csshost'. This is a common technique used by malware or malicious actors to achieve persistence by ensuring the 'csshost' executable or script runs automatically whenever a user logs in.