Persistence via autostart/Run keys, services, LaunchAgents, or cron referencing java/.jar

Ethan Andrews@eandrews

•updated Jul 6, 2026•3•0•24

Detects the creation or modification of persistence mechanisms (Windows Registry Run/RunOnce keys, Cron jobs, Systemd services, and macOS LaunchAgents/LaunchDaemons) that specifically reference Java executables or .jar files. This pattern is consistent with cross-platform malware such as QuimaRAT attempting to maintain persistence.