Question Analysis

DeviceRegistryEvents | where RegistryKey has 'TermService' and RegistryValueName has 'ServiceDll' | project RegistryValueData

DeviceRegistryEvents | where RegistryKey contains "TermService" and RegistryValueName == "ServiceDll" | project RegistryValueData

DeviceRegistryEvents | where RegistryKey has "TermService" and RegistryValueName == "ServiceDll" | project TimeGenerated, DeviceName, InitiatingProcessAccountName, RegistryKey, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine | order by TimeGenerated desc

DeviceRegistryEvents | where ActionType =~ "RegistryValueSet" | where RegistryKey has "Services\\TermService\\Parameters" and RegistryValueName =~ "ServiceDll" | project RegistryKey, RegistryValueName, RegistryValueData

DeviceRegistryEvents | where RegistryKey contains "TermService" and RegistryValueName == "ServiceDll" | project DeviceName, TimeGenerated, RegistryKey, ServiceDllFileName = RegistryValueData | order by TimeGenerated desc

DeviceRegistryEvents | where RegistryKey has "TermService" and RegistryValueName == "ServiceDll" | project TimeGenerated, DeviceName, RegistryKey, RegistryValueData | take 10

DeviceRegistryEvents | where RegistryValueName == "ServiceDll" and RegistryKey contains "TermService" | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessFileName

DeviceRegistryEvents | where RegistryValueName =~ "ServiceDll" | where RegistryKey has "termservice" and RegistryKey has_any ("currentcontrolset","controlset001","controlset002") | where ActionType == "RegistryValueSet" or isempty(ActionType) | extend ServiceDllFile = extract(@"([^\\/:]+?)(?:\s*,.*)?$", 1, tostring(RegistryValueData)) | where isnotempty(ServiceDllFile) | order by TimeGenerated desc | project TimeGenerated, DeviceName, ServiceDllFile, RegistryValueData, PreviousRegistryValueData, RegistryKey, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine | take 1

DeviceRegistryEvents | where isnotempty(RegistryValueName) and tolower(RegistryValueName) == "servicedll" | where tolower(RegistryKey) contains "termservice" | extend RawValue = tostring(RegistryValueData) // remove surrounding quotes | extend CleanValue = trim('"', RawValue) // normalize common %SystemRoot% references (lowercased for replace operations) | extend CleanValueLower = tolower(CleanValue) | extend Normalized = replace_string(CleanValueLower, "%systemroot%\\", "c:\\windows\\") | extend Normalized = replace_string(Normalized, "%systemroot%", "c:\\windows") // extract the file name portion | extend DllFileName = tostring(split(Normalized, "\\")[-1]) // summarize to get the most recent time seen per DLL and include some sample context | summarize LatestTime = max(TimeGenerated), AnyDevice = any(DeviceName), AnyInitiatingProcess = any(InitiatingProcessFileName), SampleRegistryKey = any(RegistryKey), SampleRegistryValueData = any(RegistryValueData) by DllFileName | order by LatestTime desc

let events = DeviceRegistryEvents | where tolower(RegistryValueName) == "servicedll" and tolower(RegistryKey) has "termservice" | extend RawValue = tostring(RegistryValueData) // remove surrounding quotes and normalize slashes | extend Norm = trim('"', trim("'", RawValue)) | extend Norm = replace(@"\\", '/', Norm) // extract last path component ending with .dll | extend ServiceDllFile = tolower(extract(@"([^/]+\.dll)$", 1, Norm)) | where isnotempty(ServiceDllFile) | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RawValue, ServiceDllFile, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName; // summary of distinct DLL file names plus context of the most recent event for each events | summarize Count = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by ServiceDllFile, RawValue | join kind=inner ( events | summarize arg_max(TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName) by ServiceDllFile ) on ServiceDllFile | project ServiceDllFile, Count, FirstSeen, LastSeen, RawValue, LastEventTime = TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName | order by LastSeen desc | limit 50

DeviceRegistryEvents | where isnotempty(RegistryKey) and isnotempty(RegistryValueName) | extend rk = tolower(RegistryKey), rvn = tolower(RegistryValueName) | where rvn == "servicedll" and rk contains "termservice" | extend rawValue = tostring(RegistryValueData) | extend rawValue = trim(" '\"\t\n\r", rawValue) | extend DLLFile = extract("([^\\\\/]+)$", 1, rawValue) | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, rawValue, DLLFile, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, ActionType | summarize arg_max(TimeGenerated, *) by DLLFile | order by TimeGenerated desc | take 50

DeviceRegistryEvents | where RegistryValueName == "ServiceDll" | where RegistryKey contains "TermService" // TermService registry key | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData | extend PathParts = split(tostring(RegistryValueData), "\\") | extend ServiceDllFileName = tostring(PathParts[-1]) | project TimeGenerated, DeviceName, RegistryKey, ServiceDllFileName, RegistryValueData | sort by TimeGenerated desc

DeviceRegistryEvents | where RegistryKey contains "TermService" | where RegistryValueName == "ServiceDll" | extend FileName = extract("[^\\\\]*$", 0, RegistryValueData) | summarize by FileName, DeviceName, InitiatingProcessFileName, Timestamp | order by Timestamp desc

DeviceRegistryEvents | where ActionType == 'RegistryValueSet' // Filter for set operations | where RegistryKey contains 'TermService' // Target the relevant registry key | where RegistryValueName == 'ServiceDll' // Focus on the specific value name | project Timestamp, DeviceName, RegistryKey, RegistryValueName, RegistryValueData // Select relevant fields | order by Timestamp desc // Sort by time for latest events | take 10 // Limit to top 10 results for review

DeviceRegistryEvents | where RegistryKey has "TermService" | where RegistryValueName == "ServiceDll" | order by TimeGenerated desc | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData

DeviceRegistryEvents | where RegistryKey has "\\Services\\TermService\\Parameters" // or contains "TermService" | where RegistryValueName == "ServiceDll" | where ActionType in ("RegistryValueSet", "RegistryValueModified", "SetValue", "ValueNameAdded") | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, PreviousRegistryValueData, InitiatingProcessAccountName, InitiatingProcessFileName, ActionType | order by TimeGenerated desc

// Time filter will be injected by the caller DeviceRegistryEvents | where TimeGenerated >= ago(30d) // placeholder – overwritten by function time range | where ActionType in ("RegistryValueSet", "RegistryValueCreated", "RegistryValueModified") | where RegistryKey has "\\Services\\TermService\\Parameters" and RegistryValueName =~ "ServiceDll" // Pick the latest write per device so we get the final value | summarize arg_max(TimeGenerated, RegistryValueData, PreviousRegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine) by DeviceId, DeviceName | extend ServiceDllPath = tostring(RegistryValueData) | extend ServiceDllFileName = tostring(split(ServiceDllPath, "\\")[-1]) | project TimeGenerated, DeviceName, ServiceDllFileName, ServiceDllPath, PreviousValue = PreviousRegistryValueData, ChangedBy = InitiatingProcessFileName, ChangedByCmd = InitiatingProcessCommandLine

DeviceRegistryEvents | where RegistryKey contains "TermService" and RegistryValueName == "ServiceDll" | extend DllFilePath = RegistryValueData | extend DllFileName = extract(@"([^\\]+\.dll)$", 1, DllFilePath) | project TimeGenerated, DeviceName, DllFileName, DllFilePath, InitiatingProcessAccountName, InitiatingProcessCommandLine | sort by TimeGenerated desc

DeviceRegistryEvents | where RegistryKey contains "TermService" and RegistryValueName == "ServiceDll" | extend DLLFileName = tostring(extract("([^\\\\]+\\.dll)$", 1, RegistryValueData)) | project TimeGenerated, DeviceName, RegistryKey, RegistryValueData, DLLFileName | order by TimeGenerated desc

DeviceRegistryEvents | where RegistryKey endswith @"\Services\TermService\Parameters" | where RegistryValueName == "ServiceDll" | where ActionType == "RegistryValueSet" | project TimeGenerated, DeviceName, InitiatingProcessAccountName, RegistryValueData | extend DllFileName = tostring(split(RegistryValueData, "\\")[-1]) | distinct DllFileName