TOKYOCORE BootExecute Registry Persistence via bootexec.bat
Detects unauthorized modification of the BootExecute Registry key to execute a file named 'bootexec.bat'. The BootExecute key, located in 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager', is processed by the Windows Session Manager during early system boot. Adversaries can leverage this to maintain persistence or execute malicious code before most security products initialize.
Sigma
