Uncommon Persistence via Registry Modification

registry where event.action== "modification" and
 registry.data.strings != null and not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and

 (
  (process.code_signature.trusted == false or process.code_signature.exists == false) or
  process.name : ("reg.exe", "rundll32.exe", "regsvr32.exe", "powershell.exe", "mshta.exe", "cscript.exe", "wscript.exe") or
  process.executable : ("?:\\Users\\Public\\*", "?:\\Windows\\Microsoft.NET\\*")

  )

  and

  registry.path : (
          "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Load",
		 "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Run",
		 "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell",
		 "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell",
		 "HKEY_USERS\\*\\Environment\\UserInitMprLogonScript",
		 "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit",
		 "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Shell",
		 "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logoff\\Script",
		 "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logon\\Script",
		 "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Shutdown\\Script",
		 "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Startup\\Script",
		 "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Ctf\\LangBarAddin\\*\\FilePath",
		 "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\*\\Exec",
		 "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Command Processor\\Autorun") and

  not process.executable : "?:\\Program Files (x86)\\ASUS\\OOBERegBackup\\OOBERegBackup.exe" and
  not (registry.value == "shell" and registry.data.strings : "C:\\Program Files (x86)\\KioWare Client Platform\\KioWare Client.exe -Shell -LogOffExit") and
  not (registry.value == "Shell" and registry.data.strings : "*\\Windows\\System32\\ImagineOneLauncherv3.exe*")