Wow6432Node Windows NT CurrentVersion Autorun Keys Modification
Detects modifications to specific Windows Registry keys under the `Wow6432Node\Microsoft\Windows NT\CurrentVersion` path, which are commonly used for autostart extensibility points (ASEPs). Specifically, it looks for changes to `Appinit_Dlls` and `Image File Execution Options` which can be abused for persistence or privilege escalation.
Sigma
