PAPERMILL RunOnce persistence via masqueraded RuntimeBroker.exe

Ankit Mehta@Secvyn

•updated Sep 16, 2026•0•0•1

Detects the modification or creation of registry entries in the 'RunOnce' hive that attempt to execute 'RuntimeBroker.exe' from suspicious or non-standard locations such as 'AppData' or 'MyData'. This behavior is characteristic of an adversary attempting to maintain persistence by masquerading as a legitimate Windows system process.