Modifies WinLogon for persistence

UAC bypass

Windows security bypass

Boot or Logon Autostart Execution: Active Setup

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

Command and Scripting Interpreter: PowerShell

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

Disables RegEdit via registry modification

Disables Task Manager via registry modification

Event Triggered Execution: Image File Execution Options Injection