WinGet DSC Registry Run Key Persistence via PowerShell or reg.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects modifications to Windows Run or RunOnce registry keys by PowerShell or Reg.exe processes, specifically when originating from the WinGet DSC (Desired State Configuration) stack. The rule flags entries where the registry value points to potentially sensitive/user-writable directories or contains evidence of encoded command execution (e.g., PowerShell base64 encoding or common obfuscated syntax).