registry where host.os.type == "windows" and event.type == "change" and 
 registry.data.strings != null and registry.hive : ("HKEY_USERS", "HKLM") and
 registry.path : (
     /* Machine Hive */
     "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
     "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
     "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\*",
     "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
     "HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell\\*",
     /* Users Hive */
     "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
     "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
     "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\*",
     "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
     "HKEY_USERS\\*\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell\\*"
     ) and
  /* add common legitimate changes without being too restrictive as this is one of the most abused AESPs */
  not registry.data.strings : "ctfmon.exe /n" and
  not (registry.value : "Application Restart #*" and process.name : "csrss.exe") and
  not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
  not registry.data.strings : ("*:\\Program Files\\*",
                               "*:\\Program Files (x86)\\*",
                               "*:\\Users\\*\\AppData\\Local\\*",
                               "* --processStart *",
                               "* --process-start-args *",
                               "ms-teamsupdate.exe -UninstallT20",
                               " ",
                               "grpconv -o", "* /burn.runonce*", "* /startup",
                               "?:\\WINDOWS\\SysWOW64\\Macromed\\Flash\\FlashUtil32_*_Plugin.exe -update plugin") and
  not process.executable : ("?:\\Windows\\System32\\msiexec.exe",
                            "?:\\Windows\\SysWOW64\\msiexec.exe",
                            "D:\\*",
                            "\\Device\\Mup*",
                            "C:\\Windows\\SysWOW64\\reg.exe",
                            "C:\\Windows\\System32\\changepk.exe",
                            "C:\\Windows\\System32\\netsh.exe",
                            "C:\\$WINDOWS.~BT\\Sources\\SetupPlatform.exe",
                            "C:\\$WINDOWS.~BT\\Sources\\SetupHost.exe",
                            "C:\\Program Files\\Cisco Spark\\CiscoCollabHost.exe",
                            "C:\\Sistemas\\Programas MP\\CCleaner\\CCleaner64.exe",
                            "C:\\Program Files (x86)\\FastTrack Software\\Admin By Request\\AdminByRequest.exe",
                            "C:\\Program Files (x86)\\Exclaimer Ltd\\Cloud Signature Update Agent\\Exclaimer.CloudSignatureAgent.exe",
                            "C:\\ProgramData\\Lenovo\\Vantage\\AddinData\\LenovoBatteryGaugeAddin\\x64\\QSHelper.exe",
                            "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\*\\Installer\\setup.exe",
                            "C:\\ProgramData\\bomgar-scc-*\\bomgar-scc.exe",
                            "C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil*_pepper.exe",
                            "C:\\Windows\\System32\\spool\\drivers\\x64\\3\\*.EXE",
                            "C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\*\\AdobeARM.exe")