Skip to content

Hide Navigation Hide TOC

Registry Persistence via Explorer Run Key (b7916c2a-fa2f-4795-9477-32b731f70f11)

Detects a possible persistence mechanism using RUN key for Windows Explorer and pointing to a suspicious folder

Cluster A Galaxy A Cluster B Galaxy B Level
Registry Persistence via Explorer Run Key (b7916c2a-fa2f-4795-9477-32b731f70f11) Sigma-Rules Registry Run Keys / Startup Folder - T1547.001 (9efb1ea7-c37b-4595-9640-b7680cd84279) Attack Pattern 1
Registry Run Keys / Startup Folder - T1547.001 (9efb1ea7-c37b-4595-9640-b7680cd84279) Attack Pattern Boot or Logon Autostart Execution - T1547 (1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf) Attack Pattern 2