WinSock2 Autorun Keys Modification

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•13

Detects modifications to the WinSock2 Parameters registry keys, specifically within Protocol_Catalog9 and NameSpace_Catalog5 entries. These modifications can be used for persistence by adversaries to load malicious code or redirect network traffic.