Add file from suspicious location to autostart registry

 1title: Add file from suspicious location to autostart registry
 2status: experimental
 3description: Add file from suspicious location to autostart registry
 4author: Joe Security
 5date: 2020-03-19
 6id: 200067
 7threatname:
 8behaviorgroup: 2
 9classification: 4
10mitreattack:
11
12logsource:
13    category: process_creation
14    product: windows
15detection:
16    selection:
17        CommandLine:
18            - '*reg add *\windows\currentversion\run /f /v *\appdata\roaming*'
19            - '*reg add *\windows\currentversion\run /v *\appdata\local*'
20            - '*reg add *\software\microsoft\windows nt\currentversion\windows*/v load*appdata\roaming*'
21    condition: selection
22level: critical