Autostart Registry Run Key Modified Remotely
This rule detects remote modification attempts of the 'Run' key within the Windows Registry, which is commonly used for persistence by malware and legitimate applications to automatically start programs when a user logs in. The detection specifically looks for network traffic on port 445 (SMB) containing the string 'CurrentVersion\Run', indicating an attempt to interact with this registry path remotely.
Suricata
