Uncommon Persistence via Registry Modification

[rule]
description = """
Detects changes to registry persistence keys that are not commonly used or modified by legitimate programs. This could
be an indication of an adversary's attempt to persist in a stealthy manner.
"""
id = "f64dd390-f4ea-47d1-ab7f-8fc3263fb478"
license = "Elastic License v2"
name = "Uncommon Persistence via Registry Modification"
os_list = ["windows"]
reference = ["https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2"]
version = "1.0.25"

query = '''
registry where event.action== "modification" and
 registry.data.strings != null and not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and

 (
  (process.code_signature.trusted == false or process.code_signature.exists == false) or
  process.name : ("reg.exe", "rundll32.exe", "regsvr32.exe", "powershell.exe", "mshta.exe", "cscript.exe", "wscript.exe") or
  process.executable : ("?:\\Users\\Public\\*", "?:\\Windows\\Microsoft.NET\\*")

  )

  and

  registry.path : (
          "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Load",
		 "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Run",
		 "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell",
		 "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell",
		 "HKEY_USERS\\*\\Environment\\UserInitMprLogonScript",
		 "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit",
		 "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Shell",
		 "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logoff\\Script",
		 "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logon\\Script",
		 "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Shutdown\\Script",
		 "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Startup\\Script",
		 "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Ctf\\LangBarAddin\\*\\FilePath",
		 "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\*\\Exec",
		 "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Command Processor\\Autorun") and

  not process.executable : "?:\\Program Files (x86)\\ASUS\\OOBERegBackup\\OOBERegBackup.exe" and
  not (registry.value == "shell" and registry.data.strings : "C:\\Program Files (x86)\\KioWare Client Platform\\KioWare Client.exe -Shell -LogOffExit") and
  not (registry.value == "Shell" and registry.data.strings : "*\\Windows\\System32\\ImagineOneLauncherv3.exe*")
'''

min_endpoint_version = "8.0.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1547"
name = "Boot or Logon Autostart Execution"
reference = "https://attack.mitre.org/techniques/T1547/"
[[threat.technique.subtechnique]]
id = "T1547.001"
name = "Registry Run Keys / Startup Folder"
reference = "https://attack.mitre.org/techniques/T1547/001/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.0.0"