During Operation Honeybee, the threat actors used batch files that allowed them to establish persistence by adding the following Registry key: `"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost" /v COMSysApp /t REG_MULTI_SZ /d "COMSysApp" /f`.