Obsidian Sandstorm: Run Key Persistence to AppData/Temp/ProgramData with Prior Suspicious Execution

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects an executable or file running from a common temporary or user-writable location (e.g., AppData, Temp, ProgramData) that is followed within two hours by a modification to a Windows 'Run' registry key referencing a file in the same suspicious directory structure.