Windows Registry CurrentVersion Autorun Key Modification
Detects modifications to various autostart extensibility points (ASEPs) within the Windows Registry's CurrentVersion key. This rule specifically looks for changes to common Run, RunOnce, RunServices, ShellServiceObjectDelayLoad, and other related keys that are frequently abused for persistence and privilege escalation. The rule includes extensive filters for known legitimate software and system processes to reduce false positives.
Sigma
