Common Autorun Registry Key Modification
Detects modifications to common autostart extensibility points (ASEP) in the Windows Registry. These registry keys are frequently used by legitimate software and adversaries to establish persistence by ensuring programs execute automatically upon system boot or user logon. The rule specifically targets a wide range of registry paths associated with autorun functionality, including those for Command Processor, Active Setup, Internet Explorer, and various system services. It includes filters to reduce false positives from known legitimate Microsoft Office, Chrome, Edge, and Internet Explorer activities.
Sigma
