Registry Run Key Modification for Persistence with Scripting Host

Ankit Mehta@Secvyn

•updated Jun 23, 2026•3•0•7

Detects modifications to Registry Run or RunOnce keys that include references to 'ManageEngine' or 'SystemOptimizer' and attempt to execute scripting hosts like wscript, cscript, powershell, or cmd. This behavior is indicative of persistence mechanisms often used by adversaries.