BootExecute Value Modified in Session Manager Registry Key

Subhankar H@Andrewsec57

•updated Jul 6, 2026•0•0•2

Detects modifications to the 'BootExecute' registry value within the 'Session Manager' key. The 'BootExecute' value, typically set to 'autocheck autochk *', controls programs that execute automatically during the Windows boot process. Adversaries can add arbitrary executables or scripts to this multi-string value to achieve persistence and gain code execution before user logon.