All Detections

Active Setup Registry Key for Persistence

avatar
Darshan Thummar@Mighty
updated Jun 27, 20260010

Detects use of Active Setup registry keys for per-user program execution on login

Microsoft Sentinel (KQL)