QEMU-Related Registry Persistence via Run Keys or SYSTEM\CurrentControlSet

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects modifications to Windows Registry persistence keys (Run keys, ControlSet, and file class associations) where the value being written contains strings associated with virtualization (qemu, .qcow2), potential malware/tools (bisrv.dll), or sensitive components (vault.db, TPMProfiler). This behavior is indicative of an adversary attempting to establish persistence or inject malicious modules via registry hooks.