attack.t1547.001 — sigma-tag tag

Meaning and evidence boundary

Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.

Related pages

• Classes Autorun Keys Modification · sigma-rule
• Common Autorun Keys Modification · sigma-rule
• CurrentControlSet Autorun Keys Modification · sigma-rule
• CurrentVersion Autorun Keys Modification · sigma-rule
• CurrentVersion NT Autorun Keys Modification · sigma-rule
• Direct Autorun Keys Modification · sigma-rule
• File Creation In Suspicious Directory By Msdt.EXE · sigma-rule
• Internet Explorer Autorun Keys Modification · sigma-rule
• Modify User Shell Folders Startup Value · sigma-rule
• Narrator's Feedback-Hub Persistence · sigma-rule
• New RUN Key Pointing to Suspicious Folder · sigma-rule
• Office Autorun Keys Modification · sigma-rule
• Potential Persistence Attempt Via Run Keys Using Reg.EXE · sigma-rule
• Potential Startup Shortcut Persistence Via PowerShell.EXE · sigma-rule
• Potential Suspicious Activity Using SeCEdit · sigma-rule
• Registry Persistence via Explorer Run Key · sigma-rule
• Session Manager Autorun Keys Modification · sigma-rule
• Startup Folder File Write · sigma-rule
• Suspicious Autorun Registry Modified via WMI · sigma-rule
• Suspicious PowerShell In Registry Run Keys · sigma-rule
• Suspicious Run Key from Download · sigma-rule
• Suspicious Startup Folder Persistence · sigma-rule
• System Scripts Autorun Keys Modification · sigma-rule
• User Shell Folders Registry Modification via CommandLine · sigma-rule
• VBScript Payload Stored in Registry · sigma-rule
• Windows Event Log Access Tampering Via Registry · sigma-rule
• WinRAR Creating Files in Startup Locations · sigma-rule
• WinSock2 Autorun Keys Modification · sigma-rule
• Wow6432Node Classes Autorun Keys Modification · sigma-rule
• Wow6432Node CurrentVersion Autorun Keys Modification · sigma-rule
• Wow6432Node Windows NT CurrentVersion Autorun Keys Modification · sigma-rule