Important Detection 2026: Registry Run Key and Startup Folder Persistence (T1547.001)
Detects modifications to Windows Registry persistence keys (Run, RunOnce, RunServices, RunServicesOnce) where the referenced executable or script path resides in low-trust locations such as AppData, Temp, or Public directories. This pattern is commonly used by adversaries to establish persistence after initial execution.
Sigma
