suspicious-keywords-in-registry

id: 749f313e-08b4-48f6-9f9d-ba57c1abbf55
name: suspicious-keywords-in-registry
description: |
  Looks for suspicious keyword additions to windows registry.
  Author: Jouni Mikkola
  References:
  https://threathunt.blog/registry-hunts/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceRegistryEvents
tactics:
- Defense evasion
relevantTechniques:
  - T1112
query: |
  DeviceRegistryEvents
  | where Timestamp > ago(30d)
  | where ActionType has_any ('RegistryValueSet','RegistryKeyCreated')
  | where RegistryValueData has_any('xor','new-item','invoke-expression','iex','sleep','invoke-','System.Net.HttpWebRequest','webclient','iwr','curl')  // Look for common obfuscation techniques or commands used in malicious scripts
  | project Timestamp, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName  // Project relevant fields for analysis