Classes Autorun Keys Modification

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•13

Detects modifications to specific registry keys under the 'Classes' hive that are commonly used as autostart extensibility points (ASEPs). These modifications can be used by adversaries to establish persistence or elevate privileges by ensuring their code executes automatically.