Suspicious Autorun Registry Modification via WMI and Reg.exe
Detects suspicious activity where the WMIC process is used to create an autorun registry entry via reg.exe, which is often indicative of persistence mechanisms employed by malware. The rule specifically looks for `wmic.exe` or `wmiprvse.exe` as a parent process, executing `reg.exe add` commands to modify `Run` registry keys, and targeting suspicious file paths commonly used by malware for persistence.
Sigma
