LARP53RAT persistence via Startup LNK, RunOnce key, or fake MicrosoftEdgeUpdate task

Subhankar H@Andrewsec57

•updated Jul 3, 2026•1•0•4

Detects specific persistence artifacts associated with LARP53RAT, including unauthorized file shortcuts in the Startup folder, modifications to RunOnce registry keys for system recovery, and suspicious scheduled task creation masquerading as Microsoft Edge updates.