Skip to content

Hide Navigation Hide TOC

Direct Autorun Keys Modification (24357373-078f-44ed-9ac4-6d334a668a11)

Detects direct modification of autostart extensibility point (ASEP) in registry using reg.exe.

Cluster A Galaxy A Cluster B Galaxy B Level
Direct Autorun Keys Modification (24357373-078f-44ed-9ac4-6d334a668a11) Sigma-Rules Registry Run Keys / Startup Folder - T1547.001 (9efb1ea7-c37b-4595-9640-b7680cd84279) Attack Pattern 1
Registry Run Keys / Startup Folder - T1547.001 (9efb1ea7-c37b-4595-9640-b7680cd84279) Attack Pattern Boot or Logon Autostart Execution - T1547 (1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf) Attack Pattern 2