OceanLotus registry activity

id: 3e571521-6f73-423f-9280-aff6170c9d81
name: OceanLotus registry activity
description: |
  Original Sigma Rule: https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2018/TA/APT32-Oceanlotus/registry_event_apt_oceanlotus_registry.yml
  Questions via Twitter: @janvonkirchheim.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceRegistryEvents
query: |
  DeviceRegistryEvents 
  | where Timestamp > ago(7d)
  | where ActionType == "RegistryValueSet" 
  | where RegistryKey endswith @"\SOFTWARE\Classes\CLSID\{E08A0F4B-1F65-4D4D-9A09-BD4625B9C5A1}\Model" 
       or RegistryKey endswith @"\SOFTWARE\App\AppXbf13d4ea2945444d8b13e2121cb6b663\Application" 
       or RegistryKey endswith @"\SOFTWARE\App\AppXbf13d4ea2945444d8b13e2121cb6b663\DefaultIcon" 
       or RegistryKey endswith @"\SOFTWARE\App\AppX70162486c7554f7f80f481985d67586d\Application" 
       or RegistryKey endswith @"\SOFTWARE\App\AppX70162486c7554f7f80f481985d67586d\DefaultIcon" 
       or RegistryKey endswith @"\SOFTWARE\App\AppX37cc7fdccd644b4f85f4b22d5a3f105a\Application" 
       or RegistryKey endswith @"\SOFTWARE\App\AppX37cc7fdccd644b4f85f4b22d5a3f105a\DefaultIcon"