PythonRAT Persistence via Registry Run Key in User Profiles

Ankit Mehta@Secvyn

•updated Aug 5, 2026•5•0•3

This rule detects persistence mechanisms via Windows Registry Run or RunOnce keys, specifically targeting the execution of Python scripts or common interpreted/executable files located in suspicious user profile directories (AppData, Temp, or Public folders). This behavior is characteristic of adversaries using Python-based remote access trojans (RATs) to maintain a foothold on a compromised host.