Registry Run Key Persistence via reg.exe for Backdoor Auto-Start

Ibrahim Saud@tektrix

•updated Jul 2, 2026•2•0•2

Detects the modification of Windows Registry 'Run' keys using the command-line utility 'reg.exe'. This technique is commonly employed by adversaries to establish persistence, ensuring that malicious code, such as the MiniJunk backdoor, executes automatically upon system login.