Registry Run Key or Startup Folder Persistence by Stealer/Loader Payload

Ibrahim Saud@tektrix

•updated Jul 3, 2026•5•1•7

This rule detects persistence mechanisms established by either modifying common Windows 'Run' registry keys or by placing executable files within user Startup folders. These techniques are commonly used by malware and adversaries to ensure their code executes automatically upon user logon.