Session Manager Autorun Keys Modification

Google SecOps@GoogleSecOps

•updated Jun 25, 2025•0•34

Detects modifications to specific registry keys under 'System\CurrentControlSet\Control\Session Manager' that are used for autostart extensibility points (ASEPs). These keys include 'SetupExecute', 'S0InitialCommand', 'KnownDLLs', 'Execute', 'BootExecute', and 'AppCertDLLs'. Adversaries often modify these keys to establish persistence or elevate privileges by ensuring their malicious code runs automatically during system boot or user login.