Registry Modification via WMI StdRegProv

api where
  process.Ext.api.name == "IWbemServices::ExecMethod" and user.id != "S-1-5-18" and
   process.Ext.api.parameters.operation : "*StdRegProv::SetStringValue*" and

   process.executable != "C:\\Program Files (x86)\\GreenwayTR\\GMTGC.exe" and

   not (process.code_signature.trusted == true and
        process.code_signature.subject_name in ("Reason Cybersecurity Inc.", "Micro-Star International CO., LTD.", "Lansweeper NV", "LANSWEEPER NV", "YANDEX LLC", "Beijing Sogou Technology Development Co., Ltd.", "HP Inc.", "95895A1E-217A-4242-9200-7E698391758E", "Omnissa, LLC", "Beijing Kingsoft Security software Co.,Ltd")) and
       
   not (process.executable == "C:\\Windows\\SysWOW64\\wscript.exe" and process.parent.executable == "C:\\Windows\\SysWOW64\\cmd.exe" and
        process.command_line in ("WSCRIPT /B parseXML.vbs base_agentdata.xml agentdata.xml", "WSCRIPT /B ae_scan.vbs agentdata")) and

  not (process.name : ("wscript.exe", "cscript.exe") and process.command_line : ("*\\\\*\\netlogon\\*", "\"C:\\Windows\\system32\\wscript.exe\" \"C:\\Program Files (x86)\\RoomSeeker\\DBChange.vbs\"")) and 

   not (process.executable == "C:\\Windows\\System32\\wscript.exe" and process.parent.executable == "C:\\Windows\\System32\\gpscript.exe") and

   not (process.executable : "C:\\Windows\\System32\\svchost.exe" and process.parent.executable : "C:\\Windows\\System32\\services.exe") and

   not process.executable : ("C:\\Windows\\System32\\cscript.exe",
                             "C:\\Windows\\SysWOW64\\cscript.exe",
                             "C:\\Windows\\System32\\msiexec.exe",
                             "C:\\Windows\\SysWOW64\\msiexec.exe",
                             "C:\\Program Files (x86)\\Sage\\*.exe") and
   not process.parent.executable : ("C:\\Program Files (x86)\\PCMatic\\PCPitstopScheduleService.exe",
                                    "C:\\Program Files (x86)\\Sage\\Sage 100\\9.0\\Shared\\OLStart.exe",
                                    "E:\\BELOFF_2O2O.O3L\\wpi\\WPI.exe")