Avemaria 20230918 Registry

KQL detection rule by reversinglabs · MIT

this query identifies a potential registry key created by recent avemaria samples

// this query identifies a potential registry key created by recent avemaria samples
let KeyPath = @"(?i)\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run";
let DataValue = @"(?i)C:\\users\\.*\\AppData\\Local\\Chrome\\StikyNot.exe";
SysmonParser
| where (EventID == 12 and TargetObject contains strcat(@"HKCU", KeyPath))
or (EventID == 13 and TargetObject contains strcat(@"HKCU", KeyPath, @"\Microsoft OneDrive") and Details matches regex DataValue)
| union (
DeviceRegistryEvents
| where (ActionType == "RegistryKeyCreated" and RegistryKey contains strcat(@"HKEY_CURRENT_USER", KeyPath))
 or (ActionType == "RegistryValueSet" and RegistryKey contains KeyPath and RegistryValueName == "Microsoft OneDrive" and RegistryValueData matches regex DataValue)
)

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

95df451e-fff2-4a8c-a2f3-4bf1d2e25648

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion