T1547.001
Boot or Logon Autostart Execution: Registry Run Keys
discovered 2026-05-26Copies binary to %LOCALAPPDATA%\Microsoft\Windows\0\svchost.exe and sets HKCU\Software\Microsoft\Windows\CurrentVersion\Run\svchost for boot persistence.
View on MITRE ATT&CK