Add Port Monitor Persistence in Registry

SigmaHQ Detections@sigmaHQ

•updated Nov 26, 2025•0•0•1

Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.