Suspicious autostart
Suspicious autostart
Checks for an autostart that is attempting to load a dynamic link library (DLL) from the internet.
Control
Create or edit a configuration profile with the following information:
Create or edit the following script and configure it to run when the check fails:
Check
Use the policy below to verify
SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM startup_items WHERE path = "regsvr32" AND args LIKE "%http%");
Edit page
SOC2 Type 2
© 2025 Fleet Inc.
Privacy
