CurrentVersion NT Autorun Keys Modification
Detects modifications to autostart extensibility points (ASEP) within the Windows Registry, specifically focusing on keys under 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion' that are commonly used for persistence. This includes modifications to Winlogon, Windows, Image File Execution Options, Font Drivers, and Drivers32 subkeys. The rule includes filters for known legitimate activities by Microsoft Edge, Microsoft Office, OneDrive, Avira, and .NET Framework's NGEN.
Sigma
