Windows registry artifactRunNotification
New in Windows 11, compare with other more researched Autoruns artifacts
- Autoruns
- 1 key
NTUSER
Registry keys
1 key that RECmd reads for this artifact
NTUSERSoftware\Microsoft\Windows\CurrentVersion\RunNotificationNew in Windows 11, compare with other more researched Autoruns artifacts
References
1 link
Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)