Wow6432Node Classes Autorun Keys Modification

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•12

Detects modifications to specific autostart extensibility points (ASEPs) within the Wow6432Node Classes registry path. These registry keys are often abused by adversaries to establish persistence or elevate privileges by ensuring their malicious code executes upon system startup or user logon.