Persistence via a Process from a Removable or Mounted ISO Device

sequence by process.entity_id with maxspan=5m
 [process where event.action == "start" and
  (
   (process.Ext.device.product_id : ("Virtual DVD-ROM", "Virtual Disk", "USB *") and not process.executable : "C:\\*") or

   descendant of [process where event.action == "start" and
   process.Ext.device.product_id : ("Virtual DVD-ROM", "Virtual Disk", "USB *") and not process.executable : "C:\\*"]
   ) and
   not process.executable :
            ("?:\\Program Files\\Microsoft Office\\root\\Integration\\Addons\\OneDriveSetup.exe",
             "?:\\Program Files (x86)\\Microsoft Office\\root\\Integration\\Addons\\OneDriveSetup.exe",
             "?:\\Program Files (x86)\\Microsoft OneDrive\\*\\FileSyncConfig.exe",
             "?:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
             "C:\\$WINDOWS.~BT\\Sources\\SetupHost.exe") and
   not (process.code_signature.subject_name :
                              ("Global Security Center", "Fabrice PARISOT", "Veeam Software Group GmbH", "Esko Software bv",
                               "Google LLC", "Sage Software Inc.", "Schneider Electric") and
        process.code_signature.trusted == true) and
   not process.hash.sha256 : "6decdc0e295f2246d684480c10266c067cbd60c03af702505b7b3d045e81df18"
 ]
 [any where event.category : ("registry", "file") and event.action != "deletion" and
   (
    (registry.data.strings != null and
     registry.path :
        ("H*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*", 
         "H*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\*", 
         "H*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*", 
         "H*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
         "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Load", 
         "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell", 
         "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell", 
         "HKEY_USERS\\*\\Environment\\UserInitMprLogonScript", 
         "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit", 
         "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Shell", 
         "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logoff\\Script", 
         "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logon\\Script", 
         "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Shutdown\\Script", 
         "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Startup\\Script", 
         "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Ctf\\LangBarAddin\\*\\FilePath", 
         "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\*\\Exec", 
         "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Command Processor\\Autorun", 
         "HKEY_USERS\\S-1-5-*_Classes\\CLSID\\*\\InprocServer32\\",
         "HKEY_USERS\\S-1-5-*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*")) or
    (file.name != null and file.path : "?:\\*\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*" and
     not file.name : "dektop.ini")
   )]