Suspicious String Value Written to Registry Run Key

[rule]
description = """
Identifies when suspicious values are written to Run and RunOnce registry keys via signed binaries. Run and RunOnce
registry keys cause programs to run each time that a user logs on and are often abused by adversaries to maintain
persistence on an endpoint.
"""
id = "727db78e-e1dd-4bc0-89b0-885cd99e069e"
license = "Elastic License v2"
name = "Suspicious String Value Written to Registry Run Key"
os_list = ["windows"]
reference = ["https://docs.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys"]
version = "1.0.43"

query = '''
registry where registry.data.strings != null and process.executable != null and
  user.id : ("S-1-5-21*", "S-1-12-*") and
  registry.path : (
      "H*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
      "H*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
      "H*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
      "H*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*") and
  not process.executable :
       ("?:\\Windows\\SysWOW64\\msiexec.exe",
	    "?:\\Windows\\system32\\msiexec.exe",
	    "C:\\Windows\\Installer\\MSI*.tmp",
	    "?:\\Windows\\SysWOW64\\Macromed\\Flash\\*.exe",
	    "?:\\Windows\\Downloaded Program Files\\*.exe",
	    "?:\\Windows\\system32\\spool\\DRIVERS\\*",
	    "?:\\Windows\\system32\\mmc.exe",
	    "?:\\Windows\\Samsung\\PanelMgr\\SSMMgr.exe",
	    "?:\\Windows\\System32\\wsl.exe",
	    "?:\\Windows\\SysWOW64\\d3con.exe",
	    "?:\\Windows\\System32\\StikyNot.exe",
	    "?:\\WINDOWS\\splwow64.exe",
	    "?:\\Program Files\\*.exe",
	    "?:\\Program Files (x86)\\*.exe",
	    "?:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil*_Plugin.exe",
	    "?:\\Windows\\System32\\wiawow64.exe",
	    "?:\\Windows\\SysWOW64\\NSIS.Library.RegTool.v3.{BF6A0CE1-774D-43F4-BC30-45E57E406CE1}.exe",
	    "?:\\Windows\\System32\\svchost.exe",
	    "\\Device\\Mup\\*.exe") and
  not (process.name : "cscript.exe" and registry.value : "ContingencyUninstallNXTSForCurrentUser") and
  not (process.name : "ZoomInfoContactContributor*.exe" and registry.value : "ZoomInfo Contact Contributor") and
  not (process.name : "rundll32.exe" and registry.value : ("bit4id csp store register*", "SafeDiveCertMgm")) and
  not (process.name : ("bomgar-scc.exe", "ThinkGear Connector.exe") and registry.value : ("Bomgar_Cleanup_*", "ThinkGear Connector")) and
  registry.data.strings :
            ("*rundll32*",
             "*regsvr32*",
             "*mshta*",
             "*msbuild*",
             "*RegAsm*",
             "*RegSvcs*",
             "*InstallUtil*",
             "*cscript*",
             "*wscript*",
             "*.js?",
             "*.js",
             "*.vbs?",
             "*.vbs",
             "*.vbe?",
             "*.vbe",
             "*.bat?",
             "*.bat",
             "*.url",
             "*.url?",
             "*.lnk",
             "*.lnk?",
             "*.jar",
             "*msxsl*",
             "*cmstp*",
             "*cerutil*",
             "*bitsadmin*",
             "*msiexec*",
             "*wmic*",
             "*powershell*",
             "*cmd.exe *",
             "*cmd * /c*",
             "*svchost*",
             "*lsass*",
             "*csrss*",
             "*winlogon*",
             "*Microsoft.Workflow.Compiler.exe*",
             "*VBScript.Encode*",
             "*http://*",
             "*WScript.Shell*",
             "*VBScript.Encode*",
             "*:\\Users\\Public\\*",
             "*:\\Users\\*\\Documents\\*",
             "*:\\Documents and Settings\\*",
             "*:\\Users\\*\\Pictures\\*",
             "*:\\Users\\*\\Music\\*",
             "*:\\Users\\*\\Pictures\\*",
			 "?:\\Users\\*\\Downloads\\*",
             "?:\\Users\\*\\Desktop\\*",
             "*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*",
             "\\\\*.exe",
             "*javaw.exe* -jar *") and not
    registry.data.strings :
                   ("*rundll32.exe*advpack.dll,DelNodeRunDLL32*",
                    "*LogiLDA.dll,LogiFetch*",
                    "*\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\*",
                    "*%ProgramFiles%*",
                    "*:\\Program Files\\*",
                    "*:\\Program Files (x86)\\*",
                    "*:\\Windows\\SystemApps\\*",
                    "*:\\Windows\\System32\\DriverStore\\*",
                    "*:\\WINDOWS\\Speech\\*",
                    "*:\\WINDOWS\\System32\\RtkAudUService*",
                    "*:\\WINDOWS\\system32\\SecurityHealthSystray.exe",
                    "*restartSAPinst.vbs*",
                    /* Issue #324 */
                    "*\\Windows\\Downloaded Program Files\\*",
                    "*\\Windows\\SysWOW64\\Macromed\\*",
                    "*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*.lnk*",
                    "*\\Pictures\\*com_Internet_Download_Manager*",
                    "cmd.exe /c \"start /min /d \"C:\\Users\\*\\AppData\\Local\\PDFProSuite\" PDFProSuite . --update\"",
                    "Powershell.exe -NoProfile -ExecutionPolicy ByPass -WindowStyle Hidden -file C:\\*\\RunOnce\\Logon.ps1",
                    "powershell.exe -windowstyle hidden -ExecutionPolicy Bypass -File",
                    "\"\\\\*Desktop.lnk\"") and

    not (process.code_signature.subject_name :
          ("Solanki Piyushkumar", "Sysinternals", "NortonLifeLock Inc.", "Bomgar Corporation", "BIT4ID SRL",
           "JACK HENRY & ASSOCIATES, INC.", "Connectify (Connectify, Inc.)", "Slack Technologies, LLC",
           "Symantec Corporation", "Loom, Inc.", "NinjaOne LLC", "BeyondTrust Corporation", "Quest Software, Inc.", 
		   "PHAM KIM LONG") and
           process.code_signature.trusted == true) and

    not (registry.value : "com.squirrel.Teams.Teams" and
        registry.data.strings : "?:\\Users\\*\\AppData\\Local\\Microsoft\\Teams\\Update.exe --processStart \"Teams.exe\" --process-start-args \"--system-initiated\"")
'''

min_endpoint_version = "8.0.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1547"
name = "Boot or Logon Autostart Execution"
reference = "https://attack.mitre.org/techniques/T1547/"
[[threat.technique.subtechnique]]
id = "T1547.001"
name = "Registry Run Keys / Startup Folder"
reference = "https://attack.mitre.org/techniques/T1547/001/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "8.0.0"