Procedure examples

BlackByte has used Registry Run keys for persistence.

APT3 places scripts in the startup folder for persistence.

Kimsuky has placed scripts in the startup folder for persistence and modified the `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce` Registry key.

Patchwork has added the path of its second-stage malware to the startup folder to achieve persistence. One of its file stealers has also persisted by adding a Registry Run key.

APT41 created and modified startup files for persistence. APT41 added a registry key in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost to establish persistence for Cobalt Strike.

Dragonfly has added the registry value ntdll to the Registry Run key to establish persistence.

Gorgon Group malware can create a .lnk file and add a Registry Run key to establish persistence.

APT32 established persistence using Registry Run keys, both to execute PowerShell and VBS scripts as well as to execute their backdoor directly.

MuddyWater has added Registry Run key KCU\Software\Microsoft\Windows\CurrentVersion\Run\SystemTextEncoding to establish persistence.

Naikon has modified a victim's Windows Run registry to establish persistence.

FIN6 has used Registry Run keys to establish persistence for its downloader tools known as HARDTACK and SHIPBREAD.

Gamaredon Group tools have registered Run keys in the registry to give malicious VBS files persistence.

Storm-1811 has created Windows Registry Run keys that execute various batch scripts to establish persistence on victim devices.

TeamTNT has added batch scripts to the startup folder.

FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.

APT18 establishes persistence via the HKCU\Software\Microsoft\Windows\CurrentVersion\Run key.

Sidewinder has added paths to executables in the Registry to establish persistence.

Mustang Panda has created the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobelmdyU to maintain persistence. Mustang Panda has also established persistence via the registry key `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`.

ZIRCONIUM has created a Registry Run key named Dropbox Update Setup to establish persistence for a malicious Python binary.

Rocke's miner has created UPX-packed files in the Windows Start Menu Folder.

APT39 has maintained persistence using the startup folder.

Contagious Interview has established persistence using InvisibleFerret malware to place a .bat file in the Startup Folder.

TA2541 has placed VBS files in the Startup folder and used Registry run keys to establish persistence for malicious payloads.

APT37's has added persistence via the Registry key HKCU\Software\Microsoft\CurrentVersion\Run\.

Higaisa added a spoofed binary to the start-up folder for persistence.

Tropic Trooper has created shortcuts in the Startup folder to establish persistence.

A dropper used by Putter Panda installs itself into the ASEP Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run with a value named McUpdate.

Several Ke3chang backdoors achieved persistence by adding a Run key.

Confucius has dropped malicious files into the startup folder `%AppData%\Microsoft\Windows\Start Menu\Programs\Startup` on a compromised host in order to maintain persistence.

Leviathan has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.

A Turla Javascript backdoor added a local_update_check value under the Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run to establish persistence. Additionally, a Turla custom executable containing Metasploit shellcode is saved to the Startup folder to gain persistence.

RedCurl has established persistence by creating entries in `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`.

APT29 added Registry Run keys to establish persistence.

Dark Caracal's version of Bandook adds a registry key to HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run for persistence.

BRONZE BUTLER has used a batch script that adds a Registry Run key to establish malware persistence.

Darkhotel has been known to establish persistence by adding programs to the Run Registry key.

LazyScripter has achieved persistence via writing a PowerShell script to the autorun registry key.

Windshift has created LNK files in the Startup folder to establish persistence.

LuminousMoth has used malicious DLLs that setup persistence in the Registry Key `HKCU\Software\Microsoft\Windows\Current Version\Run`.

APT28 has deployed malware that has copied itself to the startup directory for persistence.

RTM has used Registry run keys to establish persistence for the RTM Trojan and other tools, such as a modified version of TeamViewer remote desktop software.

Lazarus Group has maintained persistence by loading malicious code into a startup folder or by adding a Registry Run key.

Silence has used HKCU\Software\Microsoft\Windows\CurrentVersion\Run, HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and the Startup folder to establish persistence.

Cobalt Group has used Registry Run keys for persistence. The group has also set a Startup path to launch the PowerShell shell command and download Cobalt Strike.

Wizard Spider has established persistence via the Registry key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and a shortcut within the startup folder.

Molerats saved malicious files within the AppData and Startup folders to maintain persistence.

Moonstone Sleet used registry run keys for process execution during initial victim infection.

Inception has maintained persistence by modifying Registry run key value
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\.

VOID MANTICORE has created Windows Registry entries to autorun stage two malware payloads to maintain persistence.

PROMETHIUM has used Registry run keys to establish persistence.