Threat intelligence / Mitigation
Registry Run Keys / Startup Folder Mitigation
Identify and block potentially malicious software that may be executed through run key or startup folder persistence using whitelisting (Citation: Beechey 2010) tools like AppLocker (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
Mitigation
TypeMitigation
External ID—
First seen2026-08-14
Last seen2026-08-14
Confidence
—
Identify and block potentially malicious software that may be executed through run key or startup folder persistence using whitelisting (Citation: Beechey 2010) tools like AppLocker (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
0 recorded
Relationships
No relationships recorded.
6 external
References
Beechey 2010
http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599
openWindows Commands JPCERT
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html
openNSA MS AppLocker
https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm
open