huntrule

Malicious Run Key Persistence Pointing to Renamed PowerShell via Axios Compromise

PremiumReviewedSigma · High · v1
Product
windows
Category
registry_set
Author
HuntRule
Published
2026-09-19
Updated
2026-09-19
AnalysisDetection

ATT&CK techniques

Persistence → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects a CurrentVersion Run key value whose data references the renamed wt.exe interpreter or a script staged in ProgramData or TEMP as used by the Axios supply chain RAT for persistence. Attackers register the masqueraded PowerShell to re establish the implant at logon, ensuring durable access to the compromised host.

Reporting behind it

Related detections9 linkedT1547.001 — drag to rearrange
Suspicious SCMBanker Autostart Persistence via Run Key VBScript
Suspicious PowerShell Persistence via Registry Run Key
Possible SHELBY Backdoor Persistence via Run Key Referencing AppData HTTPApi
Suspicious Run Key Persistence Pointing to Test Executable via Registry Set
Malicious WmRAT Persistence via vcswin Run Key (via registry_set)
Malicious PlugX Persistence via LMIGuardian Update Run Key (via registry_set)
Malicious axios NPM Supply Chain Persistence via MicrosoftUpdate Run Key
Malicious Registry Run Key Persistence Masquerading as MicrosoftUpdate
Malicious Run Key Persistence Referencing DLL in User Documents
Malicious Run Key Persistence Pointing to Renamed PowerShell via Axios Compromise
Pivot detection · T1547.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.