Stealer/1.0 Registry Run Key Persistence via reg.exe

Subhankar H@Andrewsec57

•updated Aug 31, 2026•0•0•3

Detects the use of reg.exe to create persistence via Windows Registry Run or RunOnce keys using specific naming conventions commonly associated with Stealer/1.0 malware (e.g., SystemUpdate, SystemCheck) targeting files located in the Downloads directory.