name: Suspicious persistence via registry modification
id: 1f496a17-4f0c-491a-823b-7a70adb9919c
version: 1.0.1
description: |
  Adversaries may abuse the registry to achieve persistence
  by modifying the keys that are unlikely modified by legitimate
  processes.
labels:
  tactic.id: TA0006
  tactic.name: Persistence
  tactic.ref: https://attack.mitre.org/tactics/TA0006/
  technique.id: T1547
  technique.name: Boot or Logon Autostart Execution
  technique.ref: https://attack.mitre.org/techniques/T1547/
  subtechnique.id: T1547.001
  subtechnique.name: Registry Run Keys / Startup Folder
  subtechnique.ref: https://attack.mitre.org/techniques/T1547/001/

condition: >
  modify_registry
    and
  (
    (ps.name in script_interpreters or ps.name in ('reg.exe', 'rundll32.exe', 'regsvr32.exe'))
      or
     ps.exe imatches '?:\\Users\\Public\\*'
      or
     pe.is_signed = false or pe.is_trusted = false
  )
    and
  registry.key.name imatches registry_persistence_keys

min-engine-version: 2.0.0
