Millenium RAT Run Key Persistence via Masquerading Executables

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule monitors for the creation or modification of Windows Registry Run/RunOnce keys by executables residing in non-standard, user-writable directories (e.g., AppData, Temp, Downloads). It triggers when an initiating process performs this action while using masquerading names (matching common system binaries), using suspicious lure-themed naming, or when the run key value points to AppData for a file lacking version metadata, which are patterns observed in Millenium RAT activity.