Suspicious Svchost Registry Modification

[rule]
description = """
Identifies modification of the Windows shared services registry key. Adversaries may use this technique to maintain
persistence or run with System privileges.
"""
id = "055ce112-f2ad-418b-bce1-5fbe46e703fc"
license = "Elastic License v2"
name = "Suspicious Svchost Registry Modification"
os_list = ["windows"]
version = "1.0.21"

query = '''
registry where registry.key : "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost" and

 registry.data.type : "REG_MULTI_SZ" and process.executable : ("?:\\*", "\\Device\\Mup\\*") and registry.data.strings != null and

 not (registry.value : "print" and registry.data.strings : "PrintNotify") and

 not (process.executable : "?:\\Windows\\System32\\poqexec.exe" and user.id : "S-1-5-18") and

 not (process.executable : "?:\\Program Files*\\Microsoft\\AzureAttestService\\AzureAttestServiceInstaller.exe" and
      registry.value : "AzureAttestService") and

 not process.executable :
             ("?:\\Windows\\System32\\msiexec.exe",
              "?:\\Windows\\System32\\svchost.exe",
              "?:\\Windows\\WinSxS\\*\\TiWorker.exe",
              "?:\\Windows\\System32\\drvinst.exe",
              "?:\\Windows\\System32\\spoolsv.exe",
              "?:\\Windows\\System32\\regsvr32.exe",
              "?:\\Windows\\System32\\wbem\\WinMgmt.exe",
              "C:\\Windows\\System32\\PrintIsolationHost.exe",
              "?:\\Windows\\Regedit.exe",
              "?:\\Windows\\VeeamVssSupport\\VeeamGuestHelper.exe",
              "?:\\Program Files\\ForeScout SecureConnector\\SecureConnector.exe",
              "?:\\Program Files\\UVK - Ultra Virus Killer\\UVK_en64.exe",
              "C:\\Windows\\SoftwareDistribution\\Download\\Install\\osrssinst.exe") and
 not (process.code_signature.subject_name == "Arcadia Laboratories Inc." and process.code_signature.trusted == true)
'''

min_endpoint_version = "8.1.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1543"
name = "Create or Modify System Process"
reference = "https://attack.mitre.org/techniques/T1543/"
[[threat.technique.subtechnique]]
id = "T1543.003"
name = "Windows Service"
reference = "https://attack.mitre.org/techniques/T1543/003/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "8.1.0"