Skip to content
Threat Feed
Subscribe

Product

Endpoint Detection and Response

1 brief RSS
high advisory

Detection of Registry Keys Used for Persistence

This brief outlines a detection strategy for identifying modifications to Windows registry keys commonly used for persistence, including Run, Winlogon, and Image File Execution Options, enabling detection engineers to alert on unauthorized system startup entries for malicious code execution to prevent persistent access.

Splunk Enterprise +3 persistence registry windows endpoint malware
1r 1t