Registry Run Key or Startup Folder Persistence Pointing to Temp/AppData Payloads

Ibrahim Saud@tektrix

•updated Jul 3, 2026•6•1•12

Detects modifications to Windows Registry 'Run' or 'RunOnce' keys where the registered value points to suspicious locations such as Temp, AppData, or Downloads directories, which is a common technique for establishing persistence.