Run Once Task Configuration in Registry (c74d7efc-8826-45d9-b8bb-f04fac9e4eff)
Rule to detect the configuration of Run Once registry key. Configured payload can be run by runonce.exe /AlternateShellStartup
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Modify Registry - T1112 (57340c81-c025-4189-8fa0-fc7ede51bae4) | Attack Pattern | Run Once Task Configuration in Registry (c74d7efc-8826-45d9-b8bb-f04fac9e4eff) | Sigma-Rules | 1 |