Manipulation of 'BootExecute' Registry run key

BIOC Informational

Manipulation of 'BootExecute' Registry run key

Smss.exe will launch anything present in the BootExecute Registry key under HKLM\SYSTEM\ControlSet002\Control\Session Manager. The BootExecute key should only contain "autocheck autochk*". If there are additional values in it, they are probably used for malware persistence.

Module:: Platform Analytics
Agent event type:: Registry
Category:: Persistence
Status:: Enabled

ATT&CK tactics: Persistence (TA0003)

ATT&CK techniques: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (T1547.001)

Indicator:

Registry action type = all AND registry key name = *\Control\Session Manager AND registry value name = BootExecute Host host os = windows

Preventable: yes