Registry Run Key Persistence - T1547.001

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•2

Detects modifications or creations of registry values within common Windows auto-start locations, specifically the 'Run' and 'Winlogon' keys. These locations are frequently abused by adversaries to maintain persistence on a host. The rule excludes common, legitimate installer and administration processes to reduce noise.