Startup Persistence by a Low Reputation Process

sequence by process.entity_id with maxspan=5m
 [process where event.action == "start" and
 (process.Ext.relative_file_creation_time <= 1800 or process.Ext.relative_file_name_modify_time <= 1800) and
 (process.code_signature.trusted == false or process.code_signature.exists == false) and
 not process.code_signature.status like "errorCode_endpoint*" and
 not process.pe.imphash in ("952608687d343553fa2ebbe1a801044c",
                            "2ac0df3cb49d714c81e70b5b92c304f2",
                            "367254f4e83f62f5437681fde2e55f48",
                            "0d45614ce1da2206df8b743dab46d7e4") and
 not process.hash.sha256 :
                 ("933129e6153f10ed921d772467507389fc4f5d58846b89d3d7b5799cb23eb9b6",
                  "43eceb752381fc93992a317a3df6e3921f06ed5e45de808a75ffe3fe2e0afb89",
                  "f40b81f1d192c9494f35353df39072debe72c1284e3d16859979476ba1fad96f",
                  "d348833bf2d4666c5eff291d828d018bb70769dafdaf05347b63c5afcf5e2961",
                  "339a9a4b49467f9797204a5e27d73a8d72cc6c91ff1e9132a01910b20a64a48b",
                  "6a88b5179dd5560d3e11ba0962b23a414a9f26838a7a80472453437d821c8047",
                  "a9a5e36f77e5031436d8eaf16a01bdb27dc301a632eda8b0c0613d8508dca5c2",
                  "a748e17d33fe2dd47371c3c1d9a6625eeb871a262e508d15cb81de62e1cce7ac",
                  "035dfedcac91168ae84873a5eab6fc81cc914d2b8092babc162b019a885203e9",
                  "4f2629239477b651b96a456ec867ffb8f316bc7d87bab911f137bf5f74514268",
                  "901a1857c16856a3bf8854dbcd5813e15fc5cf5b13abee1ec9468c721977f415",
                  "756c03e14eeea5ce275fa4e5efd5b2af4c18deff55b2c7622ce6c21c7f226332",
                  "22ee08ed8c02358f994b5deba0940735b161f9a73ad60e4e57d10b9e1988ec83",
                  "4626fe6b05a7582fb3c824bae7b17f7418ec7796fb3e9ef22cb88af5516e084b",
                  "d57cdf9fe51debc65441be155eddb663cebfaec1c0c91161234dd3398ca71b76",
                  "04c9afe31fa9fd8340d19b0c0dd11ad9387f5f3e38045a04e4cdb97c8ebfa90b",
                  "d57cdf9fe51debc65441be155eddb663cebfaec1c0c91161234dd3398ca71b76",
                  "7428a9ceb04e588440d4847f3896ca2e024964e5e22111f2726cdd8c9445e1f4",
                  "a356832423f7fe4f2047daeefb33f968b8e2d6e87541e6d461baa4d0fc10fe76",
                  "ca7a8dabbd526f20bc0a947e9fb1e68d47c5aaf339c677d4f8d6bc90d07c1298",
                  "f1580a81a26f3b106f8c9169552191557037a019f4b6fd61ed86efc2ef2b0cc3",
                  "ce5576f49666f06fbb6798ce23b127075b66d45bb05affa55c2ab875adad2069",
                  "fb4e88e790fa47ba403b1142183e4288437963db487b56c7e02407fa2808cbec",
                  "7810ddb62441ed631136ed2e0d5c4a0f7ebe1fdb00b7db32f6952222ecef2b36",
                  "f112a55944329900e670033dc84560703fa4e271bf5be13cc5a14da603155548",
                  "a7bf2135d423ef1a84c35780bb8208a85df23c7228dbb2e3d5b9d5aec989ad2b",
                  "4997ec399b1292a8698366c605ebfaf72cb5089682a75c408978cb87c8d3a5a3",
                  "6680172392ee701a714d14bb010a00a054e102c664152bfc244dd74d0e32694d",
                  "2e2750ca395a0104571e97a77301d6332631592bd9062d6be425a2b32a049ed5") and
 not (process.executable : "C:\\Windows\\Temp\\AgentInstall.exe" and user.id : "S-1-5-18") and
 not process.executable : ("?:\\Windows\\ccmcache\\*.exe", "C:\\Windows\\SystemTemp\\*.exe") and
 not (process.executable : "C:\\Users\\*\\AppData\\Local\\Temp\\is-*.tmp\\*.tmp" and process.args : "/SL5=$*")]
 [any where event.category : ("registry", "file") and event.action != "deletion" and
   (
    (registry.data.strings != null and
     registry.path :
         ("H*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
		 "H*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
		 "H*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
		 "H*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
		 "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Load",
		 "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell",
		 "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell",
		 "HKEY_USERS\\*\\Environment\\UserInitMprLogonScript",
		 "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit",
		 "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Shell",
		 "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logoff\\Script",
		 "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logon\\Script",
		 "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Shutdown\\Script",
		 "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Startup\\Script",
		 "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Ctf\\LangBarAddin\\*\\FilePath",
		 "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\*\\Exec",
		 "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Command Processor\\Autorun",
		 "*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
		 "*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\*",
		 "*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
		 "*\\exefile\\shell\\open\\command\\*") and
     not registry.data.strings : ("\"C:\\Program Files*", "C:\\Program Files*")
     ) or
    (file.name != null and file.path : "?:\\*\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*")
   )]