QEMU Child Process Registry Modification for Persistence (T1112)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects registry modifications (specifically key creation or value setting) initiated by QEMU system binaries or their child processes, focusing on paths commonly associated with persistence (Run keys) or general software configuration storage.