Registry Run Key Persistence - Obsidian Sandstorm Implant Families

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•4

Detects persistence attempts via modifications to Windows Registry Run keys, either through direct registry operations or via the execution of 'reg.exe'. It specifically flags suspicious registry value data (e.g., paths in Temp or AppData) and instances where non-standard binaries are utilized to perform these operations.