GOLD ENCOUNTER Registry Modification for Persistence and Defense Evasion

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects malicious registry modifications performed via 'reg.exe', 'regedit.exe', or PowerShell that indicate attempts to establish persistence through Run keys and service creation, or to impair security defenses by disabling features such as Windows Defender's AntiSpyware and RealtimeMonitoring, as associated with the GOLD ENCOUNTER, STAC4713, and STAC3725 campaigns.