Payload written to spoofed 'C:\Windows \SysWOW64' path with Run key persistence

Ibrahim Saud@tektrix

•updated Sep 22, 2026•1•0•6

This rule detects the creation of a file within the SysWOW64 directory followed by an immediate modification or creation of a Windows Run registry key within a 10-minute window. This behavior is indicative of a persistence mechanism where a malicious file is dropped to a system directory and registered for execution at system startup or user logon.