Suspicious Registry Modifications
This query detects suspicious registry modifications that could indicate persistence mechanisms or system configuration tampering by attackers.
#event_simpleName=RegGenericValue
| RegObjectName=/\\(Run|RunOnce|Winlogon|AppInit_DLLs|Image File Execution Options)/i
| RegValueName!=/^(ctfmon|SecurityHealth|OneDrive)$/i
| join({#event_simpleName=UserIdentity}, field=AuthenticationID, include=[UserName])
| table([aid, UserName, RegObjectName, RegValueName, RegStringValue, ProcessImageFileName])This query uses CrowdStrike Query Language (CQL) to detect suspicious registry modifications:
-
Event Filtering:
#event_simpleName=RegGenericValue- Searches for registry value modification events -
High-Risk Keys:
RegObjectName=/\\(Run|RunOnce|Winlogon|AppInit_DLLs|Image File Execution Options)/i- Focuses on common persistence and execution registry locations -
Exclude Legitimate:
RegValueName!=/^(ctfmon|SecurityHealth|OneDrive)$/i- Filters out known legitimate applications -
User Context:
join({#event_simpleName=UserIdentity}, field=AuthenticationID, include=[UserName])- Enriches results with username information -
Output:
table([aid, UserName, RegObjectName, RegValueName, RegStringValue, ProcessImageFileName])- Displays registry path, value, and modifying process
