value:  Adversaries can use the autostart mechanism provided by LSA authentication packages for persistence by placing a reference to a binary in the Windows Registry. 
name: Boot or Logon Autostart Execution: Authentication Package