Modification of Session Manager Autorun Registry Keys

Windows Session Manager registry keys control critical system boot and execution processes. Adversaries frequently target these keys to achieve persistence or maintain high-privilege execution across reboots. By modifying values such as 'BootExecute', 'SetupExecute', or 'AppCertDlls', attackers can force the system to execute malicious code early in the boot sequence, often bypassing standard user-mode security controls. This activity is a known technique for both persistence and privilege escalation. Detection engineering teams should monitor registry modifications targeting these specific paths to identify suspicious additions or changes to execution strings that do not align with known software installations or legitimate administrative activity.

Impact

Successful exploitation of Session Manager registry keys allows attackers to gain persistence at the system level, ensuring their malware executes every time the machine boots. This can lead to full system compromise, exfiltration of sensitive data, and the ability to maintain long-term access within a target environment.

Recommendation

Deploy the provided Sigma rule to your SIEM to monitor for unauthorized modifications to Session Manager keys.

• Enable Sysmon or Windows Security event logging (specifically Event ID 12 or 13 for registry set/value set) to capture registry modifications.
• Tune the detection logic by creating an allowlist for known legitimate software installers or administrative scripts that require modifications to these specific registry keys.