Suspicious HKCU Run Key Persistence to Non-Standard Path

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•3

Detects the creation or modification of registry entries within the 'HKCU\...\Run' hive that point to executables located in suspicious or atypical directories such as 'ProgramData', 'Users\All Users', or specific non-standard application paths often used by malware for persistence.