A suspicious registry change was made on a Windows system modifying the Terminal Services DLL path. Investigate registry events to find out which DLL file name was set as the ServiceDll value under TermService. What was the file name?

DeviceRegistryEvents
| where RegistryKey has 'TermService' and RegistryValueName has 'ServiceDll'
| project RegistryValueData

DeviceRegistryEvents
| where RegistryKey contains "TermService" and RegistryValueName == "ServiceDll"
| project RegistryValueData

DeviceRegistryEvents
| where RegistryKey has "TermService" and RegistryValueName == "ServiceDll"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, RegistryKey, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

DeviceRegistryEvents
| where ActionType =~ "RegistryValueSet"
| where RegistryKey has "Services\\TermService\\Parameters" and RegistryValueName =~ "ServiceDll"
| project RegistryKey, RegistryValueName, RegistryValueData

DeviceRegistryEvents
| where RegistryKey contains "TermService" and RegistryValueName == "ServiceDll"
| project DeviceName, TimeGenerated, RegistryKey, ServiceDllFileName = RegistryValueData
| order by TimeGenerated desc

DeviceRegistryEvents
| where RegistryKey has "TermService" and RegistryValueName == "ServiceDll"
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueData
| take 10

DeviceRegistryEvents
| where RegistryValueName == "ServiceDll" and RegistryKey contains "TermService"
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessFileName

DeviceRegistryEvents
| where RegistryValueName =~ "ServiceDll"
| where RegistryKey has "termservice" and RegistryKey has_any ("currentcontrolset","controlset001","controlset002")
| where ActionType == "RegistryValueSet" or isempty(ActionType)
| extend ServiceDllFile = extract(@"([^\\/:]+?)(?:\s*,.*)?$", 1, tostring(RegistryValueData))
| where isnotempty(ServiceDllFile)
| order by TimeGenerated desc
| project TimeGenerated, DeviceName, ServiceDllFile, RegistryValueData, PreviousRegistryValueData, RegistryKey,
          InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine
| take 1

DeviceRegistryEvents
| where isnotempty(RegistryValueName) and tolower(RegistryValueName) == "servicedll"
| where tolower(RegistryKey) contains "termservice"
| extend RawValue = tostring(RegistryValueData)
// remove surrounding quotes
| extend CleanValue = trim('"', RawValue)
// normalize common %SystemRoot% references (lowercased for replace operations)
| extend CleanValueLower = tolower(CleanValue)
| extend Normalized = replace_string(CleanValueLower, "%systemroot%\\", "c:\\windows\\")
| extend Normalized = replace_string(Normalized, "%systemroot%", "c:\\windows")
// extract the file name portion
| extend DllFileName = tostring(split(Normalized, "\\")[-1])
// summarize to get the most recent time seen per DLL and include some sample context
| summarize LatestTime = max(TimeGenerated), AnyDevice = any(DeviceName), AnyInitiatingProcess = any(InitiatingProcessFileName), SampleRegistryKey = any(RegistryKey), SampleRegistryValueData = any(RegistryValueData) by DllFileName
| order by LatestTime desc

let events = DeviceRegistryEvents
| where tolower(RegistryValueName) == "servicedll"
  and tolower(RegistryKey) has "termservice"
| extend RawValue = tostring(RegistryValueData)
// remove surrounding quotes and normalize slashes
| extend Norm = trim('"', trim("'", RawValue))
| extend Norm = replace(@"\\", '/', Norm)
// extract last path component ending with .dll
| extend ServiceDllFile = tolower(extract(@"([^/]+\.dll)$", 1, Norm))
| where isnotempty(ServiceDllFile)
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RawValue, ServiceDllFile, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName;

// summary of distinct DLL file names plus context of the most recent event for each
events
| summarize Count = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by ServiceDllFile, RawValue
| join kind=inner (
    events
    | summarize arg_max(TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName) by ServiceDllFile
) on ServiceDllFile
| project ServiceDllFile, Count, FirstSeen, LastSeen, RawValue, LastEventTime = TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| order by LastSeen desc
| limit 50

DeviceRegistryEvents
| where isnotempty(RegistryKey) and isnotempty(RegistryValueName)
| extend rk = tolower(RegistryKey), rvn = tolower(RegistryValueName)
| where rvn == "servicedll" and rk contains "termservice"
| extend rawValue = tostring(RegistryValueData)
| extend rawValue = trim(" '\"\t\n\r", rawValue)
| extend DLLFile = extract("([^\\\\/]+)$", 1, rawValue)
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, rawValue, DLLFile, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, ActionType
| summarize arg_max(TimeGenerated, *) by DLLFile
| order by TimeGenerated desc
| take 50

DeviceRegistryEvents
| where RegistryValueName == "ServiceDll"
| where RegistryKey contains "TermService"  // TermService registry key
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData
| extend PathParts = split(tostring(RegistryValueData), "\\")
| extend ServiceDllFileName = tostring(PathParts[-1])
| project TimeGenerated, DeviceName, RegistryKey, ServiceDllFileName, RegistryValueData
| sort by TimeGenerated desc

DeviceRegistryEvents
| where RegistryKey contains "TermService"
| where RegistryValueName == "ServiceDll"
| extend FileName = extract("[^\\\\]*$", 0, RegistryValueData)
| summarize by FileName, DeviceName, InitiatingProcessFileName, Timestamp
| order by Timestamp desc

DeviceRegistryEvents
| where ActionType == 'RegistryValueSet' // Filter for set operations
| where RegistryKey contains 'TermService' // Target the relevant registry key
| where RegistryValueName == 'ServiceDll' // Focus on the specific value name
| project Timestamp, DeviceName, RegistryKey, RegistryValueName, RegistryValueData // Select relevant fields
| order by Timestamp desc // Sort by time for latest events
| take 10 // Limit to top 10 results for review

DeviceRegistryEvents
| where RegistryKey has "TermService" 
| where RegistryValueName == "ServiceDll"
| order by TimeGenerated desc
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData

DeviceRegistryEvents
| where RegistryKey has "\\Services\\TermService\\Parameters" // or contains "TermService"
| where RegistryValueName == "ServiceDll"
| where ActionType in ("RegistryValueSet", "RegistryValueModified", "SetValue", "ValueNameAdded")
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, PreviousRegistryValueData, InitiatingProcessAccountName, InitiatingProcessFileName, ActionType
| order by TimeGenerated desc

// Time filter will be injected by the caller
DeviceRegistryEvents
| where TimeGenerated >= ago(30d)  // placeholder – overwritten by function time range
| where ActionType in ("RegistryValueSet", "RegistryValueCreated", "RegistryValueModified")
| where RegistryKey has "\\Services\\TermService\\Parameters" and RegistryValueName =~ "ServiceDll"
// Pick the latest write per device so we get the final value
| summarize arg_max(TimeGenerated, RegistryValueData, PreviousRegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine) by DeviceId, DeviceName
| extend ServiceDllPath = tostring(RegistryValueData)
| extend ServiceDllFileName = tostring(split(ServiceDllPath, "\\")[-1])
| project TimeGenerated, DeviceName, ServiceDllFileName, ServiceDllPath, PreviousValue = PreviousRegistryValueData, ChangedBy = InitiatingProcessFileName, ChangedByCmd = InitiatingProcessCommandLine

DeviceRegistryEvents
| where RegistryKey contains "TermService" and RegistryValueName == "ServiceDll"
| extend DllFilePath = RegistryValueData
| extend DllFileName = extract(@"([^\\]+\.dll)$", 1, DllFilePath)
| project TimeGenerated, DeviceName, DllFileName, DllFilePath, InitiatingProcessAccountName, InitiatingProcessCommandLine
| sort by TimeGenerated desc

DeviceRegistryEvents
| where RegistryKey contains "TermService" and RegistryValueName == "ServiceDll"
| extend DLLFileName = tostring(extract("([^\\\\]+\\.dll)$", 1, RegistryValueData))
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueData, DLLFileName
| order by TimeGenerated desc

DeviceRegistryEvents
| where RegistryKey endswith @"\Services\TermService\Parameters"
| where RegistryValueName == "ServiceDll"
| where ActionType == "RegistryValueSet"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, RegistryValueData
| extend DllFileName = tostring(split(RegistryValueData, "\\")[-1])
| distinct DllFileName