[WINDOWS-POWERSHELL] PowerShell Auto Login Enabled, Possible Persistance Attempt [2/2]

alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[WINDOWS-POWERSHELL] PowerShell Auto Login Enabled, Possible Persistance Attempt [2/2]"; event_id: 4104; program: *PowerShell*; content: "New-Item
| 22
| HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon"; content: !"Base Image Script Framework"; classtype: suspicious-command; reference: url,github.com/SigmaHQ/sigma/blob/cd71edc09ca915f389e50df5b1bbb5ecd4b7f89d/rules/windows/powershell/powershell_script/posh_ps_winlogon_helper_dll.yml; sid:5005757; rev:3; metadata:updated_at 2025_05_13, mitre_tactic_id TA0003, mitre_technique_id T1547.004;)