huntrule

Suspicious Run Key Persistence via Reg Add

PremiumReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-11-03
Updated
2026-11-03
AnalysisDetection

ATT&CK techniques

Persistence → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects reg.exe adding a value under the Run, RunOnce or Shell Folders autostart keys from the command line. In the WithSecure Code Execution and Persistence Lab 2 attackers create registry autoruns with REG ADD to survive reboot. This is a common persistence technique that launches attacker code at every user logon.

Reporting behind it

Related detections9 linkedT1547.001 — drag to rearrange
Suspicious NTUSER.MAN Mandatory Profile File Created for Logon Persistence (via file_event)
Windows Registry: User Shell Folders Value Modification via reg.exe or PowerShell
Windows Registry EventLog ChannelAccess SDDL Tampering Detection
Suspicious Run Key Persistence Pointing to ProgramData Executable
Malicious Task Manager Disabling via DisableTaskMgr Policy Registry Value
Possible WSHRAT Persistence via Run Key Silent Script Execution
Malicious Run Key Persistence via wininfo64 Path by Italian Infostealer (via registry_set)
Suspicious Startup Folder LNK Persistence Creation via File System (via file_event)
Suspicious XWorm Persistence Run Key Pointing to Batch Loader via ScreenConnect Lure (via registry_set)
Suspicious Run Key Persistence via Reg Add
Pivot detection · T1547.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.