Session Manager Autorun Keys Modification (046218bd-e0d8-4113-a3c3-895a12b2b298)

Detects modification of autostart extensibility point (ASEP) in registry.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
AppCert DLLs - T1546.009 (7d57b371-10c2-45e5-b3cc-83a8fb380e4c)	Attack Pattern	Session Manager Autorun Keys Modification (046218bd-e0d8-4113-a3c3-895a12b2b298)	Sigma-Rules	1
Registry Run Keys / Startup Folder - T1547.001 (9efb1ea7-c37b-4595-9640-b7680cd84279)	Attack Pattern	Session Manager Autorun Keys Modification (046218bd-e0d8-4113-a3c3-895a12b2b298)	Sigma-Rules	1
AppCert DLLs - T1546.009 (7d57b371-10c2-45e5-b3cc-83a8fb380e4c)	Attack Pattern	Event Triggered Execution - T1546 (b6301b64-ef57-4cce-bb0b-77026f14a8db)	Attack Pattern	2
Registry Run Keys / Startup Folder - T1547.001 (9efb1ea7-c37b-4595-9640-b7680cd84279)	Attack Pattern	Boot or Logon Autostart Execution - T1547 (1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf)	Attack Pattern	2