suspicious-command-interpreters-added-to-registry

id: 74dd8aa9-996b-44b1-bf36-9ac9ef6d2c02
name: suspicious-command-interpreters-added-to-registry
description: |
  Looks for suspicious addition of command interpreters to windows registry.
  Author: Jouni Mikkola
  References:
  https://threathunt.blog/registry-hunts/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceRegistryEvents
tactics:
- Defense evasion
relevantTechniques:
  - T1112
query: |
  DeviceRegistryEvents
  // Filter out events initiated by OneDriveSetup.exe to reduce noise
  | where InitiatingProcessVersionInfoInternalFileName != @"OneDriveSetup.exe"
  // Look at events from the last 30 days
  | where Timestamp > ago(30d)
  // Consider only key set and key created actions
  | where ActionType has_any ('RegistryValueSet','RegistryKeyCreated')
  // Search for registry values containing 'powershell' or 'cmd'
  | where RegistryValueData has_any('powershell','cmd')
  // Project relevant fields for analysis
  | project Timestamp, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName