MiniJunk persistence via Run key or Startup folder .lnk

Ibrahim Saud@tektrix

•updated Jul 2, 2026•1•0•4

This rule detects potential persistence mechanisms on Windows systems by monitoring for the creation or modification of registry run keys, the use of 'reg.exe' to add entries to run keys, and the creation of shortcut files (.lnk) in the Windows Startup directory.