BTR.sys-style Boot Bus Extender service key with Args ADS config path

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•5

This rule detects the creation of a new service in HKLM\SYSTEM\CurrentControlSet\Services that includes specific suspicious command-line arguments (containing ':changelist') and is configured to start automatically (Start value '1') or belongs to the 'Boot Bus Extender' group. This behavior is often associated with persistence mechanisms where adversaries register a service to execute malicious payloads upon system startup.