Registry Run key persistence pointing to AppData/Temp payload (ClickFix stealer/loader)

Ibrahim Saud@tektrix

•updated Jul 3, 2026•4•0•11

Detects the creation or modification of Windows Registry Run/RunOnce keys that point to executable files located in suspicious directories, specifically 'AppData' or 'Temp'. This behavior is a common persistence technique used by malware and adversaries to ensure malicious binaries execute upon user logon.