✄𐘗
text code block:
✄𐘗from logs-endpoint.events.registry-*, logs-windows.sysmon_operational-*, winlogbeat-*,
  logs-windows.forwarded-*, logs-m365_defender.event-*, logs-sentinel_one_cloud_funnel.*,
  logs-crowdstrike.fdr* metadata _id, _version, _index
| where KQL(""" host.os.type : "windows" AND event.category:"registry" AND process.name:explorer.exe AND event.type : ("creation" or "change") """)
  and registry.data.strings is not null
  and (
    to_lower(registry.path) like """hkey_users\\*\\software\\microsoft\\windows\\currentversion\\explorer\\runmru\\*"""
    or to_lower(registry.path) like """\\registry\\user\\*\\software\\microsoft\\windows\\currentversion\\explorer\\runmru\\*"""
    or to_lower(registry.path) like """hku\\*\\software\\microsoft\\windows\\currentversion\\explorer\\runmru\\*"""
    or to_lower(registry.path) like """hkcu\\software\\microsoft\\windows\\currentversion\\explorer\\runmru\\*"""
    or to_lower(registry.path) like """hkey_current_user\\software\\microsoft\\windows\\currentversion\\explorer\\runmru\\*"""
  )
  and not to_lower(registry.path) like """*\\runmru\\mrulist"""
| eval registry_data = to_lower(mv_concat(registry.data.strings, " "))
| where
  // PowerShell / PowerShell 7 with suspicious arguments or content
  (
    (registry_data like "*powershell*" or registry_data like "*pwsh*") and
    (
      registry_data like "*-nop *" or 
      registry_data like "* -e *" or
      registry_data like "* -ec *" or
      registry_data like "* -en*" or
      registry_data like "*irm *" or
      registry_data like "*iwr *" or
      registry_data like "*iex *" or
      registry_data like "*iex(*" or
      registry_data like "*invoke-restmethod*" or
      registry_data like "*invoke-webrequest*" or
      registry_data like "*invoke-expression*" or
      registry_data like "*invoke-command*" or
      registry_data like "*$executioncontext.invokecommand*" or
      registry_data like "*webclient*" or
      registry_data like "*downloadstring*" or
      registry_data like "*downloadfile*" or
      registry_data like "*http*" or
      registry_data like "*bypass*" or
      registry_data like "* -w* h*" or
      registry_data like "* -w* mi*" or
      registry_data like "* -w *" or 
      registry_data like "*start-process*" or
      registry_data like "*frombase64string*" or
      registry_data like "*substring*" or
      registry_data like "*psitem.definition*" or
      registry_data like "*+*+*+*"
    )
  )
  or
  // Remote content and script execution through other utilities
  (
    registry_data like "*msiexec*" or
    registry_data like "*mshta*" or
    registry_data like "*msbuild*" or 
    registry_data like "*pcalua*" or
    registry_data like "*regsvr32*" or 
    registry_data like "*rundll32*" or
    registry_data like "*cmstp.exe*" or 
    registry_data like "*cmd*http*" or
    registry_data like "*cmd*set*&set*" or
    registry_data like "*conhost*" or
    registry_data like "*forfiles*" or
    registry_data like "*certutil*" or
    registry_data like "*curl*http*" or
    registry_data like "*wget*http*" or
    registry_data like "*bitsadmin*" or 
    registry_data like "*wmic*/f*" or 
    registry_data like "*odbcconf*" or 
    registry_data like "*cmd*nslookup*" or 
    registry_data like "*script*davwwwroot*" or 
    registry_data like "*script*@ssl*" or 
    registry_data like "*cmd*wscript*" or
    registry_data like """control.exe*\\*\\*""" or 
    registry_data like "*cmd* in (f_*" or 
    registry_data like "*cmd*davwwwroot*" or 
    registry_data like "*cmd*@ssl*" or 
    registry_data like "*cmd*pushd*" or 
    registry_data like "*cmd*/d /c for /r *" or 
    registry_data like "*-appvscript*" or 
    registry_data like "*|*powershell*" or
    registry_data like "*|*pwsh*" or
    registry_data like "*iex*irm *" or
    registry_data like "*iex*iwr *"
  )
| keep _id, _version, _index, data_stream.namespace, @timestamp, event.dataset, user.id, user.name, user.domain, host.id, host.name, agent.id, process.name, process.entity_id, process.executable, process.pid, registry.data.strings, registry.path