System Scripts Autorun Keys Modification

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•2•0•21

Detects modifications to specific registry keys under 'Software\Policies\Microsoft\Windows\System\Scripts' related to system startup, shutdown, logon, and logoff scripts. These modifications can be used to establish persistence or escalate privileges by executing malicious code at various system events.