persist via Run registry key: dyanmic: thread

mandiant · Feb 7, 2025 · 7006177 · 7006177
1 parent 0ea3394
commit 7006177
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/persistence/registry/run/persist-via-run-registry-key.yml b/persistence/registry/run/persist-via-run-registry-key.yml
@@ -6,7 +6,7 @@ rule:
       - moritz.raabe@mandiant.com
     scopes:
       static: function
-      dynamic: call
+      dynamic: thread
     att&ck:
       - Persistence::Boot or Logon Autostart Execution::Registry Run Keys / Startup Folder [T1547.001]
     mbc: