Persistence Mechanism via Registry Run Keys with Script Execution

Ankit Mehta@Secvyn

•updated Jun 25, 2026•1•0•3

This rule detects potential persistence mechanism installation by monitoring the creation of registry values in 'Run' or 'RunOnce' keys, followed by the execution of 'powershell.exe' or 'wscript.exe' on the same host within a 5-minute window.