Detect AppInit DLLs in Google Chronicle

rule appinit_dll_persistence_t1546_010 {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects AppInit DLL persistence mechanism via registry modification (T1546.010). Covers suspicious DLL path injection, enabling of AppInit loading, and disabling of signature enforcement."
    mitre_attack_tactic = "Persistence, Privilege Escalation"
    mitre_attack_technique = "T1546.010"
    severity = "HIGH"
    confidence = "HIGH"
    platform = "Windows"
    reference = "https://attack.mitre.org/techniques/T1546/010/"

  events:
    $e.metadata.event_type = "REGISTRY_MODIFICATION"
    (
      re.regex($e.target.registry.registry_key,
        `(?i)SOFTWARE\\(Wow6432Node\\)?Microsoft\\Windows NT\\CurrentVersion\\Windows$`) or
      re.regex($e.target.registry.registry_key,
        `(?i)HKEY_LOCAL_MACHINE\\SOFTWARE\\(Wow6432Node\\)?Microsoft\\Windows NT\\CurrentVersion\\Windows$`)
    )
    re.regex($e.target.registry.registry_value_name,
      `(?i)^(AppInit_DLLs|LoadAppInit_DLLs|RequireSignedAppInit_DLLs)$`)
    (
      (
        re.regex($e.target.registry.registry_value_name, `(?i)^AppInit_DLLs$`) and
        $e.target.registry.registry_value_data != "" and
        not re.regex($e.target.registry.registry_value_data, `(?i)(system32|syswow64)`)
      ) or
      (
        re.regex($e.target.registry.registry_value_name, `(?i)^LoadAppInit_DLLs$`) and
        $e.target.registry.registry_value_data = "1"
      ) or
      (
        re.regex($e.target.registry.registry_value_name, `(?i)^RequireSignedAppInit_DLLs$`) and
        $e.target.registry.registry_value_data = "0"
      )
    )

  condition:
    $e
}