Registry Run Key / Startup Folder Persistence (T1547.001)

Ibrahim Saud@tektrix

•updated 6 days ago•0•0•0

Detects modifications to Windows Registry Run/RunOnce keys or file creation events in the Startup folder by processes not identified as standard system installers or Windows Explorer, indicating potential persistence attempts.