MiniJunk Persistence via Run Key or Startup Folder Shortcut

Ibrahim Saud@tektrix

•updated Jul 2, 2026•0•0•8

Detects modification of user-level Registry Run keys (HKCU\Software\Microsoft\Windows\CurrentVersion\Run) specifically involving suspicious files, components, or potential masquerading attempts related to common startup applications like OneDrive.