Atbroker Registry Change (9577edbb-851f-4243-8c91-1d5b50c1a39b)

Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4)	Attack Pattern	Atbroker Registry Change (9577edbb-851f-4243-8c91-1d5b50c1a39b)	Sigma-Rules	1
Boot or Logon Autostart Execution - T1547 (1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf)	Attack Pattern	Atbroker Registry Change (9577edbb-851f-4243-8c91-1d5b50c1a39b)	Sigma-Rules	1