Suspicious Svchost Registry Modification

registry where registry.key : "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost" and

 registry.data.type : "REG_MULTI_SZ" and process.executable : ("?:\\*", "\\Device\\Mup\\*") and registry.data.strings != null and

 not (registry.value : "print" and registry.data.strings : "PrintNotify") and

 not (process.executable : "?:\\Windows\\System32\\poqexec.exe" and user.id : "S-1-5-18") and

 not (process.executable : "?:\\Program Files*\\Microsoft\\AzureAttestService\\AzureAttestServiceInstaller.exe" and
      registry.value : "AzureAttestService") and

 not process.executable :
             ("?:\\Windows\\System32\\msiexec.exe",
              "?:\\Windows\\System32\\svchost.exe",
              "?:\\Windows\\WinSxS\\*\\TiWorker.exe",
              "?:\\Windows\\System32\\drvinst.exe",
              "?:\\Windows\\System32\\spoolsv.exe",
              "?:\\Windows\\System32\\regsvr32.exe",
              "?:\\Windows\\System32\\wbem\\WinMgmt.exe",
              "C:\\Windows\\System32\\PrintIsolationHost.exe",
              "?:\\Windows\\Regedit.exe",
              "?:\\Windows\\VeeamVssSupport\\VeeamGuestHelper.exe",
              "?:\\Program Files\\ForeScout SecureConnector\\SecureConnector.exe",
              "?:\\Program Files\\UVK - Ultra Virus Killer\\UVK_en64.exe",
              "C:\\Windows\\SoftwareDistribution\\Download\\Install\\osrssinst.exe") and
 not (process.code_signature.subject_name == "Arcadia Laboratories Inc." and process.code_signature.trusted == true)