BackgroundFix - WScript AppData Persistence (T1547.001)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•2

Detects the transition to the BackgroundFix stage, where a VBScript or JScript file dropped in %AppData% establishes persistence via the registry Run key and executes silently via WScript.