Runonce.exe

Executes a Run Once Task that has been configured in the registry

Execute

Persistence, bypassing defensive counter measures

Runonce.exe /AlternateShellStartup

Executes a Run Once Task that has been configured in the registry. — MITRE: T1218 — Privileges: Administrator