-- Windows Registry Persistence Detection
-- Enumerates autostart registry locations with hash/signature enrichment
-- MITRE ATT&CK: T1547.001, T1547.014, T1112

SELECT
    r.name,
    CASE
        WHEN r.data LIKE '"%' THEN substr(r.data, 2, instr(substr(r.data, 2), '"') - 1)
        WHEN instr(r.data, ' ') > 0 THEN substr(r.data, 1, instr(r.data, ' ') - 1)
        ELSE r.data
    END AS executable_path,
    r.data,
    r.key,
    r.path,
    r.type,
    datetime(r.mtime, 'unixepoch', 'UTC') AS registry_mtime_utc,
    CASE
        WHEN r.key LIKE '%\Run' THEN 'Registry Run Key'
        WHEN r.key LIKE '%\RunOnce' THEN 'Registry RunOnce Key'
        WHEN r.key LIKE '%\Winlogon' THEN 'Winlogon Persistence'
        WHEN r.key LIKE '%\Active Setup\Installed Components' THEN 'Active Setup'
        WHEN r.key LIKE '%\Policies\Explorer\Run' THEN 'Policy Run Key'
        ELSE 'Other Persistence'
    END AS persistence_type,
    a.subject_name,
    a.result AS signature_status,
    h.sha256,
    h.sha1,
    h.md5,
    f.size,
    datetime(f.mtime, 'unixepoch', 'UTC') AS file_mtime_utc,
    datetime(f.ctime, 'unixepoch', 'UTC') AS file_ctime_utc,
    f.directory
FROM registry r
LEFT JOIN hash h ON h.path = (
    CASE
        WHEN r.data LIKE '"%' THEN substr(r.data, 2, instr(substr(r.data, 2), '"') - 1)
        WHEN instr(r.data, ' ') > 0 THEN substr(r.data, 1, instr(r.data, ' ') - 1)
        ELSE r.data
    END
)
LEFT JOIN authenticode a ON a.path = (
    CASE
        WHEN r.data LIKE '"%' THEN substr(r.data, 2, instr(substr(r.data, 2), '"') - 1)
        WHEN instr(r.data, ' ') > 0 THEN substr(r.data, 1, instr(r.data, ' ') - 1)
        ELSE r.data
    END
)
LEFT JOIN file f ON f.path = (
    CASE
        WHEN r.data LIKE '"%' THEN substr(r.data, 2, instr(substr(r.data, 2), '"') - 1)
        WHEN instr(r.data, ' ') > 0 THEN substr(r.data, 1, instr(r.data, ' ') - 1)
        ELSE r.data
    END
)
WHERE (
    -- Run/RunOnce (HKLM)
    r.key = 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run'
    OR r.key = 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce'
    -- Run/RunOnce (Per-User)
    OR r.key LIKE 'HKEY_USERS\%\Software\Microsoft\Windows\CurrentVersion\Run'
    OR r.key LIKE 'HKEY_USERS\%\Software\Microsoft\Windows\CurrentVersion\RunOnce'
    -- WOW64 (32-bit on 64-bit)
    OR r.key = 'HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run'
    OR r.key = 'HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce'
    -- Policy Run Keys (often missed by EDR)
    OR r.key = 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run'
    OR r.key LIKE 'HKEY_USERS\%\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run'
    -- Winlogon (specific persistence values only)
    OR (r.key = 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon'
        AND r.name IN ('Shell', 'Userinit', 'Taskman', 'AppSetup'))
    -- Active Setup (per-user persistence on login) - only StubPath contains the command
    OR (r.key LIKE 'HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\%'
        AND r.name = 'StubPath')
)
AND r.type != 'subkey'
AND r.data IS NOT NULL
AND r.data != ''