reg.exe Registry Run Key Persistence (T1547.001)
Detects the creation or modification of Windows Registry Run keys (Run/RunOnce) by processes other than those signed by Microsoft Corporation. This is a common technique used to maintain persistence by executing programs automatically upon user logon.
SentinelOne
