Modification of Autostart Extensibility Point Registry Keys

Persistence mechanisms often leverage Windows registry keys that automatically execute applications or scripts upon user logon or system startup. By modifying specific paths under 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion' or 'HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion', an attacker can ensure their malicious code is executed with the privileges of the system or the logged-in user. Defenders must distinguish between legitimate software update behaviors and unauthorized persistence attempts. This detection focuses on monitoring 'registry_set' events across a wide range of documented ASEP locations, utilizing a comprehensive exclusion list to reduce noise generated by common administrative tools and standard application installers.

Impact

Successful manipulation of these keys allows adversaries to maintain long-term access to compromised systems, survive reboots, and potentially escalate privileges depending on the key modified and the context of the execution. This is a foundational technique used across numerous threat actor groups and malware families for post-exploitation persistence.

Recommendation

Deploy the provided Sigma detection rule to your SIEM to monitor for unauthorized modifications to Windows autostart registry keys. Given the high volume of legitimate modifications by software installers and system updates, teams should initially deploy this rule in a 'monitor-only' mode to baseline their specific environment before escalating alerts for manual investigation.