value:  APT32 established persistence using Registry Run keys both to execute PowerShell and VBS scripts as well as to execute their backdoor directly. ;; APT33 has deployed a tool known as DarkComet to the Startup folder of a victim and used Registry run keys to gain persistence. ;; APT37's has added persistence via the Registry key HKCU\Software\Microsoft\CurrentVersion\Run\. ;; APT39 has maintained persistence using the startup folder. ;; APT41 created and modified startup files for persistence. APT41 added a registry key in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost to establish persistence for Cobalt Strike. ;; Aria-body has established persistence via the Startup folder or Run Registry key. ;; Astaroth creates a startup item for persistence. ;; BabyShark has added a Registry key to ensure all future macros are enabled for Microsoft Word and Excel as well as for additional persistence. ;; Backdoor.Oldrea adds Registry Run keys to achieve persistence. ;; BACKSPACE achieves persistence by creating a shortcut to itself in the CSIDL_STARTUP directory. ;; BADNEWS installs a registry Run key to establish persistence. ;; BadPatch establishes a foothold by adding a link to the malware executable in the startup folder. ;; Bazar can create or add files to Registry Run Keys to establish persistence. ;; BBSRAT has been loaded through DLL side-loading of a legitimate Citrix executable that is set to persist through the Registry Run key location HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ssonsvr.exe. ;; Bisonal adds itself to the Registry key HKEY_CURRENT_USER\Software\Microsoft\CurrentVersion\Run\ for persistence. ;; BitPaymer has set the run key HKCU\Software\Microsoft\Windows\CurrentVersion\Run for persistence. ;; The BlackEnergy 3 variant drops its main DLL component and then creates a .lnk shortcut to that file in the startup folder. ;; Briba creates run key Registry entries pointing to malicious DLLs dropped to disk. ;; BRONZE BUTLER has used a batch script that adds a Registry Run key to establish malware persistence. ;; build_downer has the ability to add itself to the Registry Run key for persistence. ;; Carbanak stores a configuration files in the startup directory to automatically execute commands in order to persist across reboots. ;; Carberp has maintained persistence by placing itself inside the current user's startup folder. ;; Cardinal RAT establishes Persistence by setting the HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load Registry key to point to its executable. ;; ChChes establishes persistence by adding a Registry Run key. ;; Cobalt Group has used Registry Run keys for persistence. The group has also set a Startup path to launch the PowerShell shell command and download Cobalt Strike. ;; Cobian RAT creates an autostart Registry key to ensure persistence. ;; Comnie achieves persistence by adding a shortcut of itself to the startup path in the Registry. ;; CORESHELL has established persistence by creating autostart extensibility point (ASEP) Registry entries in the Run key and other Registry keys as well as by creating shortcuts in the Internet Explorer Quick Start folder. ;; One persistence mechanism used by CozyCar is to set itself to be executed at system startup by adding a Registry value under one of the following Registry keys: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run ;; CrossRAT uses run keys for persistence on Windows ;; Dark Caracal's version of Bandook adds a registry key to HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run for persistence. ;; DarkComet adds several Registry entries to enable automatic execution at every system startup. ;; Darkhotel has been known to establish persistence by adding programs to the Run Registry key. ;; DownPaper uses PowerShell to add a Registry Run key in order to establish persistence. ;; Dragonfly 2.0 added the registry value ntdll to the Registry Run key to establish persistence. ;; DustySky achieves persistence by creating a Registry entry in HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. ;; If establishing persistence by installation as a new service fails one variant of Elise establishes persistence for the created .exe file by setting the following Registry key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\svchost : %APPDATA%\Microsoft\Network\svchost.exe. Other variants have set the following Registry keys for persistence: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\imejp : [self] and HKCU\Software\Microsoft\Windows\CurrentVersion\Run\IAStorD. ;; Variants of Emissary have added Run Registry keys to establish persistence. ;; Emotet has been observed adding the downloaded payload to the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run key to maintain persistence. ;; Empire can modify the registry run keys HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run for persistence. ;; EvilBunny has created Registry keys for persistence in [HKLM|HKCU]\…\CurrentVersion\Run. ;; EvilGrab adds a Registry Run key for ctfmon.exe to establish persistence. ;; EVILNUM can achieve persistence through the Registry Run key. ;; FatDuke has used HKLM\SOFTWARE\Microsoft\CurrentVersion\Run to establish persistence. ;; FELIXROOT adds a shortcut file to the startup folder for persistence. ;; FIN10 has established persistence by using the Registry option in PowerShell Empire to add a Run key. ;; FIN6 has used Registry Run keys to establish persistence for its downloader tools known as HARDTACK and SHIPBREAD. ;; FIN7 malware has created Registry Run and RunOnce keys to establish persistence and has also added items to the Startup folder. ;; Final1stspy creates a Registry Run key to establish persistence. ;; FinFisher establishes persistence by creating the Registry key HKCU\Software\Microsoft\Windows\Run. ;; FLASHFLOOD achieves persistence by making an entry in the Registry's Run key. ;; Gamaredon Group tools have registered Run keys in the registry to give malicious VBS files persistence. ;; Gazer can establish persistence by creating a .lnk file in the Start menu. ;; gh0st RAT has added a Registry Run key to establish persistence. ;; Gold Dragon establishes persistence in the Startup folder. ;; Gorgon Group malware can create a .lnk file and add a Registry Run key to establish persistence. ;; Grandoreiro can use run keys and create link files in the startup folder for persistence. ;; GRIFFON has used a persistence module that stores the implant inside the Registry which executes at logon. ;; GuLoader can establish persistence via the Registry under HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce. ;; Hancitor has added Registry Run keys to establish persistence. ;; Helminth establishes persistence by creating a shortcut in the Start Menu folder. ;; Hi-Zor creates a Registry Run key to establish persistence. ;; Higaisa added a spoofed binary to the start-up folder for persistence. ;; Honeybee uses a batch file that configures the ComSysApp service to autostart in order to establish persistence. ;; HTTPBrowser has established persistence by setting the HKCU\Software\Microsoft\Windows\CurrentVersion\Run key value for wdm to the path of the executable. It has also used the Registry entry HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run vpdn “%ALLUSERPROFILE%\%APPDATA%\vpdn\VPDN_LU.exe” to establish persistence. ;; IcedID has established persistence by creating a Registry run key. ;; Inception has maintained persistence by modifying Registry run key value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\. ;; Some InnaputRAT variants establish persistence by modifying the Registry key HKU\\Software\Microsoft\Windows\CurrentVersion\Run:%appdata%\NeutralApp\NeutralApp.exe. ;; InvisiMole can place a lnk file in the Startup Folder to achieve persistence. ;; Ixeshe can achieve persistence by adding itself to the HKCU\Software\Microsoft\Windows\CurrentVersion\Run Registry key. ;; JCry has created payloads in the Startup directory to maintain persistence. ;; JHUHUGIT has used a Registry Run key to establish persistence by executing JavaScript code within the rundll32.exe process. ;; Kasidet creates a Registry Run key to establish persistence. ;; Kazuar adds a sub-key under several Registry run keys. ;; Several Ke3chang backdoors achieved persistence by adding a Run key. ;; Kimsuky has placed scripts in the startup folder for persistence. ;; A version of KONNI drops a Windows shortcut into the Startup folder to establish persistence. ;; Lazarus Group malware attempts to maintain persistence by saving itself in the Start menu folder or by adding a Registry Run key. ;; Leviathan has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor. ;; LoJax has modified the Registry key ‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute’ from ‘autocheck autochk ’ to ‘autocheck autoche
name: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder