Skip to content

Commit 1e65442

Browse files
Samirboustradebot-elastic
Samirbous
authored and
tradebot-elastic
committed
[Tuning] Startup or Run Key Registry Modification (#5137)
* [Tuning] Startup or Run Key Registry Modification high percentage of the FPs are for programfiles and localappdata files in the registry data string value. This tuning should drop FPs/volume significantly. * Update rules/windows/persistence_run_key_and_startup_broad.toml --------- Co-authored-by: Jonhnathan <[email protected]> (cherry picked from commit 29c4c19)
1 parent 132a946 commit 1e65442

File tree

1 file changed

+29
-212
lines changed

1 file changed

+29
-212
lines changed

‎rules/windows/persistence_run_key_and_startup_broad.toml‎

Lines changed: 29 additions & 212 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2020/11/18"
33
integration = ["endpoint"]
44
maturity = "production"
5-
updated_date = "2025/05/08"
5+
updated_date = "2025/09/18"
66

77
[transform]
88
[[transform.osquery]]
@@ -137,217 +137,34 @@ registry where host.os.type == "windows" and event.type == "change" and
137137
not registry.data.strings : "ctfmon.exe /n" and
138138
not (registry.value : "Application Restart #*" and process.name : "csrss.exe") and
139139
not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
140-
not registry.data.strings : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and
141-
not process.executable : ("?:\\Windows\\System32\\msiexec.exe", "?:\\Windows\\SysWOW64\\msiexec.exe") and
142-
not (
143-
/* Logitech G Hub */
144-
(
145-
process.code_signature.trusted == true and process.code_signature.subject_name == "Logitech Inc" and
146-
(
147-
process.name : "lghub_agent.exe" and registry.data.strings : (
148-
"\"?:\\Program Files\\LGHUB\\lghub.exe\" --background",
149-
"\"?:\\Program Files\\LGHUB\\system_tray\\lghub_system_tray.exe\" --minimized"
150-
)
151-
) or
152-
(
153-
process.name : "LogiBolt.exe" and registry.data.strings : (
154-
"?:\\Program Files\\Logi\\LogiBolt\\LogiBolt.exe --startup",
155-
"?:\\Users\\*\\AppData\\Local\\Logi\\LogiBolt\\LogiBolt.exe --startup"
156-
)
157-
)
158-
) or
159-
160-
/* Google Drive File Stream, Chrome, and Google Update */
161-
(
162-
process.code_signature.trusted == true and process.code_signature.subject_name == "Google LLC" and
163-
(
164-
process.name : "GoogleDriveFS.exe" and registry.data.strings : (
165-
"\"?:\\Program Files\\Google\\Drive File Stream\\*\\GoogleDriveFS.exe\" --startup_mode"
166-
) or
167-
168-
process.name : "chrome.exe" and registry.data.strings : (
169-
"\"?:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" --no-startup-window /prefetch:5",
170-
"\"?:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\" --no-startup-window /prefetch:5"
171-
) or
172-
173-
process.name : ("GoogleUpdate.exe", "updater.exe") and registry.data.strings : (
174-
"\"?:\\Users\\*\\AppData\\Local\\Google\\Update\\*\\GoogleUpdateCore.exe\"",
175-
"\"?:\\Users\\*\\AppData\\Local\\Google\\GoogleUpdater\\*\\updater.exe\" --wake"
176-
)
177-
)
178-
) or
179-
180-
/* MS Programs */
181-
(
182-
process.code_signature.trusted == true and process.code_signature.subject_name in ("Microsoft Windows", "Microsoft Corporation") and
183-
(
184-
process.name : "msedge.exe" and registry.data.strings : (
185-
"\"?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --no-startup-window --win-session-start /prefetch:5",
186-
"\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --win-session-start",
187-
"\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --no-startup-window --win-session-start"
188-
) or
189-
190-
process.name : ("Update.exe", "Teams.exe", "ms-teamsupdate.exe") and registry.data.strings : (
191-
"?:\\Users\\*\\AppData\\Local\\Microsoft\\Teams\\Update.exe --processStart \"Teams.exe\" --process-start-args \"--system-initiated\"",
192-
"?:\\ProgramData\\*\\Microsoft\\Teams\\Update.exe --processStart \"Teams.exe\" --process-start-args \"--system-initiated\"",
193-
"ms-teamsupdate.exe -UninstallT20"
194-
) or
195-
196-
process.name : ("OneDrive*.exe", "Microsoft.SharePoint.exe") and registry.data.strings : (
197-
"?:\\Program Files\\Microsoft OneDrive\\OneDrive.exe /background *",
198-
"?:\\Program Files (x86)\\Microsoft OneDrive\\OneDrive.exe /background*",
199-
"\"?:\\Program Files (x86)\\Microsoft OneDrive\\OneDrive.exe\" /background*",
200-
"\"?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe\" /background",
201-
"?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\??.???.????.????\\Microsoft.SharePoint.exe",
202-
"?:\\Windows\\system32\\cmd.exe /q /c * \"?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\*\""
203-
) or
204-
205-
process.name : "MicrosoftEdgeUpdate.exe" and registry.data.strings : (
206-
"\"?:\\Users\\*\\AppData\\Local\\Microsoft\\EdgeUpdate\\*\\MicrosoftEdgeUpdateCore.exe\""
207-
) or
208-
209-
process.executable : "?:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\*\\Installer\\setup.exe" and
210-
registry.data.strings : (
211-
"\"?:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\*\\Installer\\setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logon"
212-
) or
213-
214-
process.name : "BingWallpaper.exe" and registry.data.strings : (
215-
"C:\\Users\\*\\AppData\\Local\\Temp\\*\\UnInstDaemon.exe"
216-
) or
217-
218-
/* Discord Update.exe via reg.exe */
219-
process.name : "reg.exe" and registry.data.strings : (
220-
"\"C:\\Users\\*\\AppData\\Local\\Discord\\Update.exe\" --processStart Discord.exe"
221-
)
222-
)
223-
) or
224-
225-
/* Slack */
226-
(
227-
process.code_signature.trusted == true and process.code_signature.subject_name in (
228-
"Slack Technologies, Inc.", "Slack Technologies, LLC"
229-
) and process.name : "slack.exe" and registry.data.strings : (
230-
"\"?:\\Users\\*\\AppData\\Local\\slack\\slack.exe\" --process-start-args --startup",
231-
"\"?:\\ProgramData\\*\\slack\\slack.exe\" --process-start-args --startup",
232-
"\"?:\\Program Files\\Slack\\slack.exe\" --process-start-args --startup"
233-
)
234-
) or
235-
236-
/* Cisco */
237-
(
238-
process.code_signature.trusted == true and process.code_signature.subject_name in ("Cisco WebEx LLC", "Cisco Systems, Inc.") and
239-
(
240-
process.name : "WebexHost.exe" and registry.data.strings : (
241-
"\"?:\\Users\\*\\AppData\\Local\\WebEx\\WebexHost.exe\" /daemon /runFrom=autorun"
242-
)
243-
) or
244-
(
245-
process.name : "CiscoJabber.exe" and registry.data.strings : (
246-
"\"?:\\Program Files (x86)\\Cisco Systems\\Cisco Jabber\\CiscoJabber.exe\" /min"
247-
)
248-
)
249-
) or
250-
251-
/* Loom */
252-
(
253-
process.code_signature.trusted == true and process.code_signature.subject_name == "Loom, Inc." and
254-
process.name : "Loom.exe" and registry.data.strings : (
255-
"?:\\Users\\*\\AppData\\Local\\Programs\\Loom\\Loom.exe --process-start-args \"--loomHidden\""
256-
)
257-
) or
258-
259-
/* Adobe */
260-
(
261-
process.code_signature.trusted == true and process.code_signature.subject_name == "Adobe Inc." and
262-
process.name : ("Acrobat.exe", "FlashUtil32_*_Plugin.exe") and registry.data.strings : (
263-
"\"?:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\AdobeCollabSync.exe\"",
264-
"\"?:\\Program Files (x86)\\Adobe\\Acrobat DC\\Acrobat\\AdobeCollabSync.exe\"",
265-
"?:\\WINDOWS\\SysWOW64\\Macromed\\Flash\\FlashUtil32_*_Plugin.exe -update plugin"
266-
)
267-
) or
268-
269-
/* CCleaner */
270-
(
271-
process.code_signature.trusted == true and
272-
process.code_signature.subject_name in ("PIRIFORM SOFTWARE LIMITED", "Gen Digital Inc.") and
273-
process.name : ("CCleanerBrowser.exe", "CCleaner64.exe") and registry.data.strings : (
274-
"\"C:\\Program Files (x86)\\CCleaner Browser\\Application\\CCleanerBrowser.exe\" --check-run=src=logon --auto-launch-at-startup --profile-directory=\"Default\"",
275-
"\"C:\\Program Files\\CCleaner\\CCleaner64.exe\" /MONITOR"
276-
)
277-
) or
278-
279-
/* Opera */
280-
(
281-
process.code_signature.trusted == true and process.code_signature.subject_name == "Opera Norway AS" and
282-
process.name : ("opera.exe", "assistant_installer.exe") and registry.data.strings : (
283-
"?:\\Users\\*\\AppData\\Local\\Programs\\Opera\\launcher.exe",
284-
"?:\\Users\\*\\AppData\\Local\\Programs\\Opera\\opera.exe",
285-
"?:\\Users\\*\\AppData\\Local\\Programs\\Opera GX\\launcher.exe",
286-
"?:\\Users\\*\\AppData\\Local\\Programs\\Opera GX\\opera.exe",
287-
"?:\\Users\\*\\AppData\\Local\\Programs\\Opera\\assistant\\browser_assistant.exe"
288-
)
289-
) or
290-
291-
/* Avast */
292-
(
293-
process.code_signature.trusted == true and process.code_signature.subject_name == "Avast Software s.r.o." and
294-
process.name : "AvastBrowser.exe" and registry.data.strings : (
295-
"\"?:\\Users\\*\\AppData\\Local\\AVAST Software\\Browser\\Application\\AvastBrowser.exe\" --check-run=src=logon --auto-launch-at-startup*",
296-
"\"?:\\Program Files (x86)\\AVAST Software\\Browser\\Application\\AvastBrowser.exe\" --check-run=src=logon --auto-launch-at-startup*",
297-
""
298-
)
299-
) or
300-
301-
/* Grammarly */
302-
(
303-
process.code_signature.trusted == true and process.code_signature.subject_name == "Grammarly, Inc." and
304-
process.name : "GrammarlyInstaller.exe" and registry.data.strings : (
305-
"?:\\Users\\*\\AppData\\Local\\Grammarly\\DesktopIntegrations\\Grammarly.Desktop.exe",
306-
"\"?:\\Users\\*\\AppData\\Local\\Grammarly\\DesktopIntegrations\\Grammarly.Desktop.exe\""
307-
)
308-
) or
309-
310-
/* AVG */
311-
(
312-
process.code_signature.trusted == true and process.code_signature.subject_name == "AVG Technologies USA, LLC" and
313-
process.name : "AVGBrowser.exe" and registry.data.strings : (
314-
"\"C:\\Program Files\\AVG\\Browser\\Application\\AVGBrowser.exe\"*",
315-
"\"C:\\Users\\*\\AppData\\Local\\AVG\\Browser\\Application\\AVGBrowser.exe\"*"
316-
)
317-
) or
318-
319-
/* HP */
320-
(
321-
process.code_signature.trusted == true and process.code_signature.subject_name == "HP Inc." and
322-
process.name : "ScanToPCActivationApp.exe" and registry.data.strings : (
323-
"\"C:\\Program Files\\HP\\HP*"
324-
)
325-
) or
326-
327-
/* 1Password */
328-
(
329-
process.code_signature.trusted == true and process.code_signature.subject_name == "Agilebits" and
330-
process.name : "1PasswordSetup*.exe" and registry.data.strings : (
331-
"\"C:\\Users\\*\\AppData\\Local\\1Password\\app\\?\\1Password.exe\" --silent"
332-
)
333-
) or
334-
335-
/* OpenVPN */
336-
(
337-
process.code_signature.trusted == true and process.code_signature.subject_name == "OpenVPN Inc." and
338-
process.name : "OpenVPNConnect.exe" and registry.data.strings : (
339-
"C:\\Program Files\\OpenVPN Connect\\OpenVPNConnect.exe --opened-at-login --minimize"
340-
)
341-
) or
342-
343-
/* Docker */
344-
(
345-
process.code_signature.trusted == true and process.code_signature.subject_name == "Docker Inc" and
346-
process.name: "com.docker.backend.exe" and registry.data.strings : (
347-
"C:\\Program Files\\Docker\\Docker\\Docker Desktop.exe -Autostart"
348-
)
349-
)
350-
)
140+
not registry.data.strings : ("*:\\Program Files\\*",
141+
"*:\\Program Files (x86)\\*",
142+
"*:\\Users\\*\\AppData\\Local\\*",
143+
"* --processStart *",
144+
"* --process-start-args *",
145+
"ms-teamsupdate.exe -UninstallT20",
146+
" ",
147+
"grpconv -o", "* /burn.runonce*", "* /startup",
148+
"?:\\WINDOWS\\SysWOW64\\Macromed\\Flash\\FlashUtil32_*_Plugin.exe -update plugin") and
149+
not process.executable : ("?:\\Windows\\System32\\msiexec.exe",
150+
"?:\\Windows\\SysWOW64\\msiexec.exe",
151+
"D:\\*",
152+
"\\Device\\Mup*",
153+
"C:\\Windows\\SysWOW64\\reg.exe",
154+
"C:\\Windows\\System32\\changepk.exe",
155+
"C:\\Windows\\System32\\netsh.exe",
156+
"C:\\$WINDOWS.~BT\\Sources\\SetupPlatform.exe",
157+
"C:\\$WINDOWS.~BT\\Sources\\SetupHost.exe",
158+
"C:\\Program Files\\Cisco Spark\\CiscoCollabHost.exe",
159+
"C:\\Sistemas\\Programas MP\\CCleaner\\CCleaner64.exe",
160+
"C:\\Program Files (x86)\\FastTrack Software\\Admin By Request\\AdminByRequest.exe",
161+
"C:\\Program Files (x86)\\Exclaimer Ltd\\Cloud Signature Update Agent\\Exclaimer.CloudSignatureAgent.exe",
162+
"C:\\ProgramData\\Lenovo\\Vantage\\AddinData\\LenovoBatteryGaugeAddin\\x64\\QSHelper.exe",
163+
"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\*\\Installer\\setup.exe",
164+
"C:\\ProgramData\\bomgar-scc-*\\bomgar-scc.exe",
165+
"C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil*_pepper.exe",
166+
"C:\\Windows\\System32\\spool\\drivers\\x64\\3\\*.EXE",
167+
"C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\*\\AdobeARM.exe")
351168
'''
352169

353170

0 commit comments

Comments
 (0)