Registry Run Key Prefixed with Asterisk

[rule]
description = """
Run and RunOnce registry keys cause programs to run each time that a user logs on. By default, these keys are ignored
when the computer is started in Safe Mode. The value name of RunOnce keys can be prefixed with an asterisk (*) to force
the program to run even in Safe Mode. Attackers have been observed in the wild using this technique to execute
ransomware in Safe Mode.
"""
id = "94d35931-5c48-49ed-8c18-d601c4f8aeaa"
license = "Elastic License v2"
name = "Registry Run Key Prefixed with Asterisk"
os_list = ["windows"]
reference = [
    "https://docs.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys",
    "https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/",
]
version = "1.0.36"

query = '''
registry where registry.data.strings != null and
    user.id : ("S-1-5-21*", "S-1-12-*") and
    registry.path : (
      "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
      "*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
      "*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\*",
      "*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
      "*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
      "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
      "*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*"
    ) and
  startswith(registry.value, "*") and
  /* Issue #318 */
  not (process.name : "Lmi_*.exe" and registry.value : "*LogMeInRescue*") and
  not (process.name : "G2AC_LauncherCustomer.exe" and registry.value : "*GoToAssist*") and
  not (process.name : "G2AC_SessionControl.exe" and registry.value : "*GoToAssist") and
  not (process.code_signature.subject_name == "GoTo Technologies USA, LLC" and process.code_signature.trusted == true) and
  not process.executable :
           ("?:\\Windows\\System32\\mmc.exe",
            "?:\\WINDOWS\\system32\\rstrui.exe",
            "?:\\Program Files (x86)\\*.exe",
            "?:\\WINDOWS\\System32\\dllhost.exe",
            "?:\\Windows\\System32\\msiexec.exe",
            "?:\\Program Files\\*.exe")
'''

min_endpoint_version = "8.0.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1547"
name = "Boot or Logon Autostart Execution"
reference = "https://attack.mitre.org/techniques/T1547/"
[[threat.technique.subtechnique]]
id = "T1547.001"
name = "Registry Run Keys / Startup Folder"
reference = "https://attack.mitre.org/techniques/T1547/001/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "8.0.0"