STAC4749 Realtek/WinAudio Run Key and Hidden Startup Shortcut Persistence

Duo Tech@duotech

•updated Jul 31, 2026•0•0•8

Detects STAC4749 persistence mechanisms including Run key values disguised as Realtek or WinAudio audio components, mklink-%.vbs scripts used to create Startup folder shortcuts, and hidden Startup folder .lnk files disguised as SecurityHealth or OneDriveUpdate.