Autostart Entry Added via Remote Registry Write

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects attempts to add an autostart entry via a remote registry write operation targeting TCP port 445 (SMB). It specifically looks for network traffic containing the strings "Run", "HKCU" (HKEY_CURRENT_USER), and "\Software\Microsoft\Windows", indicating a modification to the current user's run keys for persistence. This activity is often associated with malware or adversaries establishing persistence on a compromised Windows system.