✄𐘗
text code block:
✄𐘗registry where host.os.type == "windows" and event.type == "change" and
  /* not necessary but good for filtering privileged installations */
  user.domain != "NT AUTHORITY" and process.executable != null and 
  (
    (
      registry.path : "HK*\\InprocServer32\\" and
      registry.data.strings: ("scrobj.dll", "?:\\*\\scrobj.dll") and
      not registry.path : "*\\{06290BD*-48AA-11D2-8432-006008C3FBFC}\\*"
    ) or

    (
      registry.path : "HKLM\\*\\InProcServer32\\*" and
        registry.data.strings : ("*\\Users\\*", "*\\ProgramData\\*")
    ) or

    /* in general COM Registry changes on Users Hive is less noisy and worth alerting */
    (
      registry.path : (
        "HKEY_USERS\\*\\InprocServer32\\",
        "HKEY_USERS\\*\\LocalServer32\\",
        "HKEY_USERS\\*\\DelegateExecute",
        "HKEY_USERS\\*\\TreatAs\\",
        "HKEY_USERS\\*\\ScriptletURL*"
      ) and
      not registry.data.strings : (
            /* COM related to Windows Spotlight feature */
            "{4813071a-41ad-44a2-9835-886d2f63ca30}",

            /* AppX/MSIX DelegateExecute handlers: execute, protocol, file */
            "{A56A841F-E974-45C1-8001-7E3F8A085917}",
            "{4ED3A719-CEA8-4BD9-910D-E252F997AFC2}",
            "{BFEC0C93-0B7D-4F2C-B09C-AFFFC4BDAE78}"
      )
    )
  ) and 
  
  not (
    process.code_signature.trusted == true and
    process.code_signature.subject_name in (
        "Island Technology Inc.", "Google LLC", "Grammarly, Inc.", "Dropbox, Inc", "REFINITIV US LLC", "HP Inc.", "Adobe Inc.",
        "Citrix Systems, Inc.", "Veeam Software Group GmbH", "Zhuhai Kingsoft Office Software Co., Ltd.", "Oracle America, Inc.",
        "Brave Software, Inc.", "DeepL SE", "Opera Norway AS"
    )
  ) and 

  /* excludes Microsoft signed noisy processes */
  not
  (
    process.name : (
      "OneDrive.exe", "OneDriveSetup.exe", "FileSyncConfig.exe", "Teams.exe", "MicrosoftEdgeUpdate.exe", "msrdcw.exe",
      "MicrosoftEdgeUpdateComRegisterShell64.exe", "setup.exe"
    ) and
    process.code_signature.trusted == true and process.code_signature.subject_name in ("Microsoft Windows", "Microsoft Corporation")
  ) and
  
  not process.executable : (
        "?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe",
        "?:\\Program Files (x86)\\*.exe",
        "?:\\Program Files\\*.exe",
        "?:\\ProgramData\\4Team\\4Team-Updater\\4Team-Updater-Helper.exe",
        "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
        "?:\\Users\\*\\AppData\\Local\\Wondershare\\Wondershare NativePush\\WsToastNotification.exe",
        "?:\\Windows\\System32\\DriverStore\\FileRepository\\*.exe",
        "?:\\Windows\\System32\\msiexec.exe",
        "?:\\Windows\\System32\\svchost.exe",
        "?:\\Windows\\SysWOW64\\regsvr32.exe",
        "?:\\Windows\\System32\\regsvr32.exe",
        "\\Device\\Mup\\*\\Kufer\\KuferSQL\\BasysSQL.exe"
  )