Suspicious Windows Authentication Registry Modification

registry where event.action == "modification" and

   process.executable : ("?:\\*", "\\Device\\Mup*") and registry.data.strings != null and

   registry.path : ("HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\Security Packages*",
                    "HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\OSConfig\\Security Packages*",
                    "HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\Notification Packages",
                    "HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\Authentication Packages",
                    "HKLM\\SYSTEM\\*ControlSet*\\Services\\NTDS\\DirectoryServiceExtPt",
                    "HKLM\\SYSTEM\\*ControlSet*\\Services\\NTDS\\LsaDbExtPt",
                    "HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\\*",
                    "HKLM\\SYSTEM\\*ControlSet*\\Services\\*\\NetworkProvider\\ProviderPath") and

   not process.executable :
             ("?:\\Windows\\System32\\msiexec.exe",
              "?:\\Windows\\SysWOW64\\msiexec.exe",
              "?:\\Windows\\Sys*\\drvinst.exe",
              "?:\\Windows\\Sys*\\poqexec.exe",
              "?:\\Windows\\System32\\lsass.exe",
              "?:\\Windows\\SysWOW64\\regsvr32.exe",
              "?:\\Windows\\system32\\regsvr32.exe",
              "?:\\Windows\\WinSxS\\*\\TiWorker.exe",
              "C:\\Windows\\System32\\svchost.exe",
              "?:\\Windows\\Sys*\\config\\systemprofile\\*",
              "?:\\Program Files\\*.exe",
              "C:\\Windows\\regedit.exe",
              "?:\\Program Files (x86)\\*.exe") and

   /* excluding signed and non Microsoft binaries */
   not (process.code_signature.trusted == true and not process.code_signature.subject_name : "Microsoft*") and

   not registry.value : ("SmartCardLogonNotify", "Asynchronous", "Enabled", "Impersonate", "Startup", "Logoff", "Logon", "Shutdown") and

   not registry.data.strings : ("*:\\Program Files\\*", "*:\\Program Files (x86)\\*", "?:\\Windows\\system32\\cbfsShellHelper20.dll") and

   not (registry.value : "notification packages" and registry.data.strings : ("kdcsvc", "rassfm", "scecli") and
        process.executable : "?:\\Windows\\System32\\services.exe") and

   not (registry.value : "ProviderPath" and registry.data.strings : "?:\\Program Files (x86)\\Citrix\\ICA Client\\x64\\pnsson.dll")