Direct Autorun Keys Modification via reg.exe

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•13

Detects direct modification of autostart extensibility point (ASEP) in the Windows Registry using the `reg.exe` utility. This rule specifically looks for the 'add' command within `reg.exe` command lines targeting common Run keys and other autostart locations.