AutoAdminLogon Registry Modification Detection

Shivam Malaviya@Shviam

•updated Jul 4, 2025•2•1•52

This detection identifies modifications to the AutoAdminLogon registry key, which can be exploited by attackers for persistence and to maintain access after system reboots.