Registry Run Key Persistence via Non-Standard Process (T1547.001)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•1

Detects the creation or modification of Windows Registry Run keys by processes that are not part of the standard Microsoft Windows installation, suggesting potential unauthorized persistence mechanisms.