Direct Autorun Registry Key Modification via Reg.exe
Detects direct modification of autostart extensibility points (ASEP) in the Windows Registry using the 'reg.exe' utility. This rule specifically looks for 'reg.exe' being executed with the 'add' command and targeting common autorun registry paths such as 'Run', 'Userinit', 'Shell', 'Windows', 'User Shell Folders', and 'AlternateShell'. Adversaries often modify these registry keys to establish persistence on a system, ensuring their malicious code executes upon system startup or user login.
YARA-L
