Office Autorun Keys Modification

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•20

Detects modifications to registry keys associated with Microsoft Office add-ins, which can be used for persistence. Adversaries may abuse these autostart extensibility points (ASEPs) to execute malicious code every time an Office application starts.