Script interpreter host or untrusted process persistence

Identifies the script interpreter or untrusted process writing to commonly abused run keys or the Startup folder locations.

• Platform: Windows
• Severity: High
• MITRE Tactic: Persistence
• MITRE Techniques: T1547, T1547.001

Back to all rules