Millenium RAT Run Key Persistence: AppData/Temp Path Written by Non-Installer

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects the creation or modification of Windows Registry Run keys that point to files within user-writable directories (AppData or Temp). This behavior is correlated with preceding execution of script interpreters (PowerShell, WScript, CScript, MSHTA, Node, or CMD) on the same endpoint, which is a common pattern for dropper or RAT installation stages.