New startup registry key in Windows 10/11, NOT captured within autoruns

Question

Hi All,
While researching the startup behavior of Windows Container (Windows Metro) Apps , like the ones installed through Microsoft Store or native to System (xbox/phone, etc),
I came across a new registry key location (different from the known standard Startup locations in HKCU/HKLM)

HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData  

• This Key evades detection within Autoruns/Autoruns64
• The only references (Based on what I could gather) to this key were the Read/Write Ops within Procmon, or the taskmanager startup tab

I used whatsapp to create/install/remove startup behavior in my testing

• Attached 2 snips with the Procmon output and Autoruns search result

Since its non-standard startup registry key location, and DOES NOT show up in autoruns, it will evade persistence detection from a lot of AV/EDR's that leverage autoruns internally to enumerate persistence.
Like Crowdstrke, Tanium, Defender ATP , etc
So if exploited, this potentially could become a blindspot for security controls that rely on autoruns

Answer 1

Thank you so much for this discovery! Try HiBit Startup Manager: https://www.hibitsoft.ir/StartupManager.html

Answer 2

thank you very much! searching for it for a while ;-)