reg pos

Hunt Hypothesis

This hypothesis targets adversaries attempting to establish persistence by registering specific registry keys or values that indicate early-stage foothold establishment within Windows endpoints. Proactive hunting for these reg_pos events in Azure Sentinel is essential to identify subtle configuration changes before they evolve into more severe, established threats that could compromise long-term system integrity.

YARA Rule

rule reg_pos
{
meta:
	author = "@patrickrolsen"
	reference = "POS malware - RegExpr"
strings:
	$s1 = "T1_FOUND: %s"
	$s2 = "id=%s&log=%s"
	$s3 = "\\d{15,19}=\\d{13,}"
condition:
	uint16(0) == 0x5A4D and 2 of ($s*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• POS malware - RegExpr
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the reg_pos detection rule in an enterprise environment, including recommended filters and exclusions:

• Endpoint Protection Agent Health Checks

  • Scenario: Security agents like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne frequently modify registry keys (e.g., under HKLM\SOFTWARE\CrowdStrike or HKCU\Software\Microsoft\Windows\CurrentVersion\Windows Defender) to update policy versions, report scan status, or rotate configuration tokens. These actions often occur every 15–30 minutes and can trigger the rule if it monitors specific value changes without context.
  • Filter/Exclusion: Exclude processes owned by known security vendors (e.g., C:\Program Files\CrowdStrike\csagent.exe, MsMpEng.exe) from triggering alerts when modifying registry paths within their own installation directories or standard policy configuration keys.

• Group Policy Object (GPO) Application

  • Scenario: During the standard background refresh cycle (default every 90 minutes with a random offset), Microsoft Group Policy Client Service (gpsvc) applies administrative templates to workstations and servers. This involves writing values to HKLM\SOFTWARE\Policies\Microsoft and HKCU\Software\Policies\Microsoft. If the rule detects registry writes by svchost.exe (specifically the gpsvc service host) during these windows, it generates noise.
  • Filter/Exclusion: Create a suppression for svchost.exe processes where the command line contains -k netsvcs or specifically identifies the gpsvc service ID, limiting the scope to registry paths starting with \SOFTWARE\Policies\Microsoft.

• Automated Software Deployment (SCCM/Intune)

  • Scenario: Enterprise deployment tools