Technique:  Boot or Logon Autostart Execution:Registry Run Keys
ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key.
Agent Tesla can add itself to the Registry as a startup program to establish persistence.
Amadey has changed the Startup folder to the one containing its executable by overwriting the registry keys.
ANDROMEDA can establish persistence by dropping a sample of itself to C:\ProgramData\Local Settings\Temp\mskmde.com and adding a Registry run key to execute every time a user logs on.
AppleSeed has the ability to create the Registry key name EstsoftAutoUpdate at HKCU\Software\Microsoft/Windows\CurrentVersion\RunOnce to establish persistence.
It establishes persistence via the HKCU\Software\Microsoft\Windows\CurrentVersion\Run key.
An It HTTP malware variant establishes persistence by setting the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Windows Debug Tools-%LOCALAPPDATA%\.
It has deployed malware that has copied itself to the startup directory for persistence.
It added Registry Run keys to establish persistence.
It places scripts in the startup folder for persistence.
It established persistence using Registry Run keys, both to execute PowerShell and VBS scripts as well as to execute their backdoor directly.
It has deployed a tool known as DarkComet to the Startup folder of a victim, and used Registry run keys to gain persistence.
It's has added persistence via the Registry key HKCU\Software\Microsoft\CurrentVersion\Run\.
It has maintained persistence using the startup folder.
It created and modified startup files for persistence. It added a registry key in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost to establish persistence for Cobalt Strike.
Aria-body has established persistence via the Startup folder or Run Registry key.
Astaroth creates a startup item for persistence.
AuTo Stealer can place malicious executables in a victim's AutoRun registry key or StartUp directory, depending on the AV product installed, to maintain persistence.
Avaddon uses registry run keys for persistence.
AvosLocker has been executed via the RunOnce Registry key to run itself on safe mode.
BabyShark has added a Registry key to ensure all future macros are enabled for Microsoft Word and Excel as well as for additional persistence.
Backdoor.Oldrea adds Registry Run keys to achieve persistence.
BACKSPACE achieves persistence by creating a shortcut to itself in the CSIDL_STARTUP directory.
BADNEWS installs a registry Run key to establish persistence.
BadPatch establishes a foothold by adding a link to the malware executable in the startup folder.
Bazar can create or add files to Registry Run Keys to establish persistence.
BBSRAT has been loaded through DLL side-loading of a legitimate Citrix executable that is set to persist through the Registry Run key location HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ssonsvr.exe.
Bisonal has added itself to the Registry key HKEY_CURRENT_USER\Software\Microsoft\CurrentVersion\Run\ for persistence.
BitPaymer has set the run key HKCU\Software\Microsoft\Windows\CurrentVersion\Run for persistence.
The BlackEnergy 3 variant drops its main DLL component and then creates a .lnk shortcut to that file in the startup folder.
BoomBox can establish persistence by writing the Registry value MicroNativeCacheSvc to HKCU\Software\Microsoft\Windows\CurrentVersion\Run.
Briba creates run key Registry entries pointing to malicious DLLs dropped to disk.
It has used a batch script that adds a Registry Run key to establish malware persistence.
build_downer has the ability to add itself to the Registry Run key for persistence.
It stores a configuration files in the startup directory to automatically execute commands in order to persist across reboots.
Carberp has maintained persistence by placing itself inside the current user's startup folder.
Cardinal RAT establishes Persistence by setting the  HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load Registry key to point to its executable.
Chaes has added persistence via the Registry key software\microsoft\windows\currentversion\run\microsoft windows html help.
ChChes establishes persistence by adding a Registry Run key.
Chinoxy has established persistence via the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key and by loading a dropper to (%COMMON_ STARTUP%\\eoffice.exe).
Clambling can establish persistence by adding a Registry run key.
It has used Registry Run keys for persistence. The group has also set a Startup path to launch the PowerShell shell command and download Cobalt Strike.
Cobian RAT creates an autostart Registry key to ensure persistence.
Comnie achieves persistence by adding a shortcut of itself to the startup path in the Registry.
Conficker adds Registry Run keys to establish persistence.
It has dropped malicious files into the startup folder %AppData%\Microsoft\Windows\Start Menu\Programs\Startup on a compromised host in order to maintain persistence.
CORESHELL has established persistence by creating autostart extensibility point (ASEP) Registry entries in the Run key and other Registry keys, as well as by creating shortcuts in the Internet Explorer Quick Start folder.
One persistence mechanism used by CozyCar is to set itself to be executed at system startup by adding a Registry value under one of the following Registry keys: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
Crimson can add Registry run keys for persistence.
CrossRAT uses run keys for persistence on Windows.
It's version of Bandook adds a registry key to HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run for persistence.
DarkComet adds several Registry entries to enable automatic execution at every system startup.
It has been known to establish persistence by adding programs to the Run Registry key.
DarkTortilla has established persistence via the Software\Microsoft\Windows NT\CurrentVersion\Run registry key and by creating a .lnk shortcut file in the Windows startup folder.
DnsSystem can write itself to the Startup folder to gain persistence.
DownPaper uses PowerShell to add a Registry Run key in order to establish persistence.
It has added the registry value ntdll to the Registry Run key to establish persistence.
DustySky achieves persistence by creating a Registry entry in HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
If establishing persistence by installation as a new service fails, one variant of Elise establishes persistence for the created .exe file by setting the following Registry key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\svchost : %APPDATA%\Microsoft\Network\svchost.exe. Other variants have set the following Registry keys for persistence: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\imejp : [self] and HKCU\Software\Microsoft\Windows\CurrentVersion\Run\IAStorD.
Variants of Emissary have added Run Registry keys to establish persistence.
Emotet has been observed adding the downloaded payload to the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run key to maintain persistence.
Empire can modify the registry run keys HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run for persistence.
EvilBunny has created Registry keys for persistence in [HKLM|HKCU]\…\CurrentVersion\Run.
EvilGrab adds a Registry Run key for ctfmon.exe to establish persistence.
EVILNUM can achieve persistence through the Registry Run key.
FatDuke has used HKLM\SOFTWARE\Microsoft\CurrentVersion\Run to establish persistence.
FELIXROOT adds a shortcut file to the startup folder for persistence.
It has established persistence by using the Registry option in PowerShell Empire to add a Run key.
It has used Windows Registry run keys such as, HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hosts to maintain persistence.
It has used Registry Run keys to establish persistence for its downloader tools known as HARDTACK and SHIPBREAD.
It malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.
Final1stspy creates a Registry Run key to establish persistence.
FinFisher establishes persistence by creating the Registry key HKCU\Software\Microsoft\Windows\Run.
Flagpro has dropped an executable file to the startup directory.
FLASHFLOOD achieves persistence by making an entry in the Registry's Run key.
FlawedAmmyy has established persistence via the HKCU\SOFTWARE\microsoft\windows\currentversion\run registry key.
FunnyDream can use a Registry Run Key and the Startup folder to establish persistence.
It tools have registered Run keys in the registry to give malicious VBS files persistence.
Gazer can establish persistence by creating a .lnk file in the Start menu.
Gelsemium can set persistence with a Registry run key.
gh0st RAT has added a Registry Run key to establish persistence.
Gold Dragon establishes persistence in the Startup folder.
It malware can create a .lnk file and add a Registry Run key to establish persistence.
Grandoreiro can use run keys and create link files in the startup folder for persistence.
GRIFFON has used a persistence module that stores the implant inside the Registry, which executes at logon.
GrimAgent can set persistence with a Registry run key.
GuLoader can establish persistence via the Registry under HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce.
Hancitor  has added Registry Run keys to establish persistence.
Helminth establishes persistence by creating a shortcut in the Start Menu folder.
Heyoka Backdoor can establish persistence with the auto start function including using the value EverNoteTrayUService.
Hi-Zor creates a Registry Run key to establish persistence.
It added a spoofed binary to the start-up folder for persistence.
HTTPBrowser has established persistence by setting the HKCU\Software\Microsoft\Windows\CurrentVersion\Run key value for wdm to the path of the executable. It has also used the Registry entry HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run vpdn "%ALLUSERPROFILE%\%APPDATA%\vpdn\VPDN_LU.exe" to establish persistence.
IcedID has established persistence by creating a Registry run key.
It has maintained persistence by modifying Registry run key value  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\.
Some InnaputRAT variants establish persistence by modifying the Registry key HKU\\Software\Microsoft\Windows\CurrentVersion\Run:%appdata%\NeutralApp\NeutralApp.exe.
InvisiMole can place a lnk file in the Startup Folder to achieve persistence.
Ixeshe can achieve persistence by adding itself to the HKCU\Software\Microsoft\Windows\CurrentVersion\Run Registry key.
JCry has created payloads in the Startup directory to maintain persistence.
JHUHUGIT has used a Registry Run key to establish persistence by executing JavaScript code within the rundll32.exe process.
Kasidet creates a Registry Run key to establish persistence.
Kazuar adds a sub-key under several Registry run keys.
Several It backdoors achieved persistence by adding a Run key.
It has placed scripts in the startup folder for persistence and modified the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce Registry key.
Koadic has added persistence to the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Registry key.
KOCTOPUS can set the AutoRun Registry key with a PowerShell command.
A version of KONNI has dropped a Windows shortcut into the Startup folder to establish persistence.
It has maintained persistence by loading malicious code into a startup folder or by adding a Registry Run key.
It has achieved persistence via writing a PowerShell script to the autorun registry key.
It has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.
LiteDuke can create persistence by adding a shortcut in the CurrentVersion\Run Registry key.
LoJax has modified the Registry key ‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute’ from ‘autocheck autochk ’ to ‘autocheck autoche ’ in order to execute its payload during Windows startup.
LookBack sets up a Registry Run key to establish a persistence mechanism.
Lucifer can persist by setting Registry key values HKLM\Software\Microsoft\Windows\CurrentVersion\Run\QQMusic and HKCU\Software\Microsoft\Windows\CurrentVersion\Run\QQMusic.
It has used malicious DLLs that setup persistence in the Registry Key HKCU\Software\Microsoft\Windows\Current Version\Run.
It used the startup folder for persistence.
It malware has used Registry Run keys to establish persistence.
MarkiRAT can drop its payload into the Startup directory to ensure it automatically runs when the compromised system is started.
Matryoshka can establish persistence by adding Registry Run keys.
Maze has created a file named "startup_vrun.bat" in the Startup folder of a virtual machine to establish persistence.
MCMD can use Registry Run Keys for persistence.
Metamorfo has configured persistence to the Registry ket HKCU\Software\Microsoft\Windows\CurrentVersion\Run, Spotify =% APPDATA%\Spotify\Spotify.exe and used .LNK files in the startup folder to achieve persistence.
Mivast creates the following Registry entry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Micromedia.
MoleNet can achieve persitence on the infected machine by setting the Registry run key.
It saved malicious files within the AppData and Startup folders to maintain persistence.
Mongall can establish persistence with the auto start function including using the value EverNoteTrayUService.
Mosquito establishes persistence under the Registry key HKCU\Software\Run auto_update.
It has added Registry Run key KCU\Software\Microsoft\Windows\CurrentVersion\Run\SystemTextEncoding to establish persistence.
It has created the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobelmdyU to maintain persistence.
It has modified a victim's Windows Run registry to establish persistence.
NanHaiShu modifies the %regrun% Registry to point itself to an autostart mechanism.
NanoCore creates a RunOnce key in the Registry to execute its VBS scripts each time the user logs on to the machine.
NavRAT creates a Registry key to ensure a file gets executed upon reboot in order to establish persistence.
Nebulae can achieve persistence through a Registry Run key.
The "SCOUT" variant of NETEAGLE achieves persistence by adding itself to the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key.
NETWIRE creates a Registry start-up entry to establish persistence.
njRAT has added persistence via the Registry key HKCU\Software\Microsoft\CurrentVersion\Run\ and dropped a shortcut in %STARTUP%.
NOKKI has established persistence by writing the payload to the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run.
ObliqueRAT can gain persistence by a creating a shortcut in the infected user's Startup directory.
Octopus achieved persistence by placing a malicious executable in the startup directory and has added the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run key to the Registry.
Okrum establishes persistence by creating a .lnk shortcut to itself in the Startup folder.
During Operation Dream Job, It placed LNK files into the victims' startup folder for persistence.
During Operation Sharpshooter, a first-stage downloader installed Rising Sun to %Startup%\mssync.exe on a compromised host.
It has added the path of its second-stage malware to the startup folder to achieve persistence. One of its file stealers has also persisted by adding a Registry Run key.
Pisloader establishes persistence via a Registry Run key.
PLAINTEE gains persistence by adding the Registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce.
PlugX adds Run key entries in the Registry to establish persistence.
PoetRAT has added a registry key in the  hive for persistence.
PoisonIvy creates run key Registry entries pointing to a malicious executable dropped to disk.
PowerDuke achieves persistence by using various Registry Run keys.
PowerShower sets up persistence with a Registry run key.
POWERSOURCE achieves persistence by setting a Registry Run key, with the path depending on whether the victim account has user or administrator access.
PowerSploit's New-UserPersistenceOption Persistence argument can be used to establish via the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key.
POWERTON can install a Registry Run key for persistence.
Prikormka adds itself to a Registry Run key with the name guidVGA or guidVSA.
It has used Registry run keys to establish persistence.
Pteranodon copies itself to the Startup folder to establish persistence.
PUNCHBUGGY has been observed using a Registry Run key.
Pupy adds itself to the startup folder or adds itself to the Registry key SOFTWARE\Microsoft\Windows\CurrentVersion\Run for persistence.
A dropper used by It installs itself into the ASEP Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run with a value named McUpdate.
QakBot can maintain persistence by creating an auto-run Registry key.
If the QuasarRAT client process does not have administrator privileges it will add a registry key to HKCU\Software\Microsoft\Windows\CurrentVersion\Run for persistence.
Ramsay has created Registry Run keys to establish persistence.
RCSession has the ability to modify a Registry Run key to establish persistence.
Reaver creates a shortcut file and saves it in a Startup folder to establish persistence.
RedLeaves attempts to add a shortcut file in the Startup folder to achieve persistence. If this fails, it attempts to add Registry Run keys.
Remcos can add itself to the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run for persistence.
Remexi utilizes Run Registry keys in the HKLM hive as a persistence mechanism.
Rifdoor has created a new registry entry at HKEY_CURRENT_USERS\Software\Microsoft\Windows\CurrentVersion\Run\Graphics with a value of C:\ProgramData\Initech\Initech.exe /run.
It's miner has created UPX-packed files in the Windows Start Menu Folder.
RogueRobin created a shortcut in the Windows startup folder to launch a PowerShell script each time the user logs in to establish persistence.
Rover persists by creating a Registry entry in HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\.
It tries to add a Registry Run key under the name "Windows Update" to establish persistence.
It has used Registry run keys to establish persistence for the It Trojan and other tools, such as a modified version of TeamViewer remote desktop software.
RunningRAT adds itself to the Registry key Software\Microsoft\Windows\CurrentVersion\Run to establish persistence upon reboot.
Ryuk has used the Windows command line to create a Registry entry under HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run to establish persistence.
S-Type may create a .lnk file to itself that is saved in the Start menu folder. It may also create the Registry key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ IMJPMIJ8.1{3 characters of Unique Identifier}.
Saint Bot has established persistence by being copied to the Startup directory or through the \Software\Microsoft\Windows\CurrentVersion\Run registry key.
Most Sakula samples maintain persistence by setting the Registry Run key SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ in the HKLM or HKCU hive, with the Registry value and file name varying by sample.
SDBbot has the ability to add a value to the Registry Run key to establish persistence if it detects it is running with regular user privilege.
SeaDuke is capable of persisting via the Registry Run key or a .lnk file stored in the Startup directory.
Seasalt creates a Registry entry to ensure infection after reboot under HKLM\Software\Microsoft\Windows\currentVersion\Run.
ServHelper may attempt to establish persistence via the HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ run key.
SharpStage has the ability to create persistence for the malware using the Registry autorun key and startup folder.
ShimRat has installed a registry based start-up key HKCU\Software\microsoft\windows\CurrentVersion\Run to maintain persistence should other methods fail.
SHIPSHAPE achieves persistence by creating a shortcut in the Startup folder.
It has added paths to executables in the Registry to establish persistence.
It has used HKCU\Software\Microsoft\Windows\CurrentVersion\Run, HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and the Startup folder to establish persistence.
SILENTTRINITY can establish a LNK file in the startup folder for persistence.
Small Sieve has the ability to add itself to HKCU\Software\Microsoft\Windows\CurrentVersion\Run\OutlookMicrosift for persistence.
Smoke Loader adds a Registry Run key for persistence and adds a script in the Startup folder to deploy the payload.
SMOKEDHAM has used reg.exe to create a Registry Run key.
Snip3 can create a VBS file in startup to persist after system restarts.
SNUGRIDE establishes persistence through a Registry Run key.
SPACESHIP achieves persistence by creating a shortcut in the current user's Startup folder.
To establish persistence, SslMM identifies the Start Menu Startup directory and drops a link to its own executable disguised as an "Office Start," "Yahoo Talk," "MSN Gaming Z0ne," or "MSN Talk" shortcut.
STARWHALE can establish persistence by installing itself in the startup folder, whereas the GO variant has created a HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OutlookM registry key.
StrongPity can use the HKCU\Software\Microsoft\Windows\CurrentVersion\Run Registry key for persistence.
Sykipot has been known to establish persistence by adding programs to the Run Registry key.
SysUpdate can use a Registry Run key to establish persistence.
It has placed VBS files in the Startup folder and used Registry run keys to establish persistence for malicious payloads.
Taidoor has modified the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run key for persistence.
TAINTEDSCRIBE can copy itself into the current user’s Startup folder as "Narrator.exe" for persistence.
It has added batch scripts to the startup folder.
It's malware can add a Registry key to Software\Microsoft\Windows\CurrentVersion\Run for persistence.
ThreatNeedle can be loaded into the Startup folder (%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\OneDrives.lnk) as a Shortcut file for persistence.
TINYTYPHON installs itself under Registry Run key to establish persistence.
TinyZBot can create a shortcut in the Windows startup folder for persistence.
TrickBot establishes persistence in the Startup folder.
Trojan.Karagany can create a link to itself in the Startup folder to automatically start itself upon system restart.
It has created shortcuts in the Startup folder to establish persistence.
Truvasys adds a Registry Run key to establish persistence.
Turian can establish persistence by adding Registry Run keys.
A It Javascript backdoor added a local_update_check value under the Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run to establish persistence. Additionally, a It custom executable containing Metasploit shellcode is saved to the Startup folder to gain persistence.
TURNEDUP is capable of writing to a Registry Run key to establish.
Ursnif has used Registry Run keys to establish automatic execution at system startup.
USBStealer registers itself under a Registry Run key with the name "USB Disk Security."
Vasport copies itself to disk and creates an associated run key Registry entry to establish.
VBShower used HKCU\Software\Microsoft\Windows\CurrentVersion\Run\[a-f0-9A-F]{8} to maintain persistence.
WarzoneRAT can add itself to the HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UIF2IS20VK Registry keys.
It has created LNK files in the Startup folder to establish persistence.
Winnti for Windows can add a service named wind0ws to the Registry to achieve persistence after reboot.
It has established persistence via the Registry key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and a shortcut within the startup folder.
Xbash can create a Startup item for persistence if it determines it is on a Windows system.
Zebrocy creates an entry in a Registry Run key for the malware to execute on startup.
Zeus Panda adds persistence by creating Registry Run keys.
ItM has created a Registry Run key named Dropbox Update Setup to establish persistence for a malicious Python binary.