Detect Boot or Logon Autostart Execution in Google Chronicle

rule t1547_boot_logon_autostart_registry {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects registry creation or modification events targeting Windows boot/logon autostart execution locations (T1547). Covers Run keys, RunOnce, Winlogon, LSA package registration, Print Monitor DLL paths, and Shell Folder redirections."
    mitre_attack_tactic = "Persistence, Privilege Escalation"
    mitre_attack_technique = "T1547"
    severity = "HIGH"
    confidence = "HIGH"

  events:
    $e.metadata.event_type = "REGISTRY_MODIFICATION"
    (
      re.regex($e.target.registry.registry_key, `(?i)\\CurrentVersion\\Run(Once(Ex)?|Services(Once)?)?\\`) or
      re.regex($e.target.registry.registry_key, `(?i)\\CurrentVersion\\Policies\\Explorer\\Run`) or
      re.regex($e.target.registry.registry_key, `(?i)\\CurrentVersion\\Winlogon`) or
      re.regex($e.target.registry.registry_key, `(?i)\\Active Setup\\Installed Components`) or
      re.regex($e.target.registry.registry_key, `(?i)\\Control\\Lsa\\(Authentication|Security) Packages`) or
      re.regex($e.target.registry.registry_key, `(?i)\\Control\\Print\\(Monitors|Environments)`) or
      re.regex($e.target.registry.registry_key, `(?i)\\Services\\W32Time\\TimeProviders`) or
      re.regex($e.target.registry.registry_key, `(?i)\\Explorer\\(User )?Shell Folders`)
    )

  condition:
    $e
}