Skip to content

Hide Navigation Hide TOC

Potential Persistence Attempt Via Run Keys Using Reg.EXE (de587dce-915e-4218-aac4-835ca6af6f70)

Detects suspicious command line reg.exe tool adding key to RUN key in Registry

Cluster A Galaxy A Cluster B Galaxy B Level
Registry Run Keys / Startup Folder - T1547.001 (9efb1ea7-c37b-4595-9640-b7680cd84279) Attack Pattern Potential Persistence Attempt Via Run Keys Using Reg.EXE (de587dce-915e-4218-aac4-835ca6af6f70) Sigma-Rules 1
Registry Run Keys / Startup Folder - T1547.001 (9efb1ea7-c37b-4595-9640-b7680cd84279) Attack Pattern Boot or Logon Autostart Execution - T1547 (1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf) Attack Pattern 2