Registry Run persistence

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Update /t REG_SZ /d "C:\Users\Public\payload.exe"

Adds an entry to the Run registry key so Windows executes the payload at each user logon.

Use it when you have access to the user session (HKCU doesn't require admin) and need to regain access after a reboot. It's the fastest persistence in Windows: works on end-user hosts, not on servers that rarely reboot.

Avoid it when the SIEM correlates Run key creation (the most common rule in any SOC) or when policy blocks autoruns. On hosts with behavior-based AV, a payload in C:\Users\Public gets flagged quickly.