This is a simple YARA rule that matches samples that contain strings related to Windows registry run keys. Malware commonly employs these keys to achieve persistence on a victim host.

This rule can definitely be improved upon, as there are different registry paths that do the same sort of thing.

rule runkeys
{
	meta:
		description = "run key strings"

	strings:
		$ = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" wide ascii nocase

	condition:
		any of them
}

YARA Rules Index