CurrentControlSet Autorun Keys Modification

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•16

Detects modifications to specific registry keys under `SYSTEM\CurrentControlSet\Control` that are commonly used for autostart extensibility points (ASEPs). These modifications can indicate persistence mechanisms being established by adversaries.