Internet Explorer Autorun Keys Modification

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•14

Detects modifications to Internet Explorer's autostart extensibility points (ASEPs) in the Windows Registry. Adversaries may modify these registry keys to establish persistence or elevate privileges by ensuring malicious code executes when Internet Explorer starts or when a user logs in.