A Windows endpoint shows an Active Setup entry under Internet Explorer Core Fonts being altered with a StubPath value. Investigate the registry events and identify the payload that was set.

DeviceRegistryEvents
| where RegistryKey has_any("Active Setup", "Internet Explorer Core Fonts")
| where RegistryValueName == "StubPath"
| project TimeGenerated, DeviceName, DeviceId, ActionType, RegistryKey, RegistryValueName, RegistryValueData
| where ActionType has "RegistryValueSet"

// Active Setup StubPath modifications and their payloads
let name_values =
    DeviceRegistryEvents
    | where RegistryKey has @"Active Setup\Installed Components"
    | where RegistryValueName in~ ("DisplayName","LocalizedName","FriendlyName","ComponentID")
    | where isnotempty(RegistryValueData)
    | summarize ComponentNameCandidates = make_set(RegistryValueData, 10) by DeviceId, DeviceName, RegistryKey;
let stub_changes =
    DeviceRegistryEvents
    | where RegistryKey has @"Active Setup\Installed Components"  // covers HKLM/HKU and WOW6432Node
    | where RegistryValueName =~ "StubPath"
    | where ActionType in ("RegistryValueSet","RegistryValueCreate")
    | project TimeGenerated, DeviceId, DeviceName, RegistryKey, ActionType,
              Payload = RegistryValueData, PreviousPayload = PreviousRegistryValueData,
              InitiatingProcessAccountDomain, InitiatingProcessAccountName,
              InitiatingProcessFileName, InitiatingProcessCommandLine,
              InitiatingProcessSHA1, InitiatingProcessSHA256,
              InitiatingProcessFolderPath, InitiatingProcessId, InitiatingProcessCreationTime;
stub_changes
| join kind=leftouter name_values on DeviceId, DeviceName, RegistryKey
| extend ComponentNameCandidates = coalesce(ComponentNameCandidates, dynamic([]))
| extend LowerNames = tolower(strcat_array(ComponentNameCandidates, "|")), LowerKey = tolower(RegistryKey)
| extend ContainsCoreFonts = iff(LowerNames has "internet explorer core fonts" or LowerNames has "core fonts" or LowerKey has "internet explorer core fonts" or LowerKey has "core fonts", true, false)
| project TimeGenerated, DeviceName, DeviceId, RegistryKey, ActionType,
          ContainsCoreFonts, ComponentNameCandidates,
          Payload, PreviousPayload,
          InitiatingProcessAccountDomain, InitiatingProcessAccountName,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          InitiatingProcessSHA1, InitiatingProcessSHA256,
          InitiatingProcessFolderPath, InitiatingProcessId, InitiatingProcessCreationTime
| order by ContainsCoreFonts desc, TimeGenerated desc

let targetKeyPatterns = dynamic(["\\Software\\Microsoft\\Internet Explorer\\Core Fonts\\Active Setup","\\Software\\Microsoft\\Internet Explorer\\Core Fonts\\Active Setup\\%","\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Core Fonts\\Active Setup","%Active Setup%Core Fonts%"]);
DeviceRegistryEvents
| where isnotempty(RegistryKey)
| where RegistryKey has_cs "Internet Explorer" or RegistryKey has_cs "Core Fonts" or RegistryKey has_cs "Active Setup"
| where RegistryValueName == "StubPath" or RegistryValueName == "(Default)" or RegistryValueName == ""
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, PreviousRegistryValueName, PreviousRegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId, InitiatingProcessAccountName, InitiatingProcessAccountDomain, ActionType
| order by TimeGenerated desc
| take 50

DeviceRegistryEvents
| where RegistryValueName == "StubPath"
| where RegistryKey has_any ("Internet Explorer Core Fonts", "IECoreFonts", "Active Setup")
| extend Payload = RegistryValueData
| project TimeGenerated, DeviceName, DeviceId, RegistryKey, RegistryValueName, Payload, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessCreationTime
| sort by TimeGenerated desc
| take 100

DeviceRegistryEvents
| where RegistryKey contains "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Active Setup\\Installed Components"
| where RegistryValueName == "StubPath"
| project DeviceName, Timestamp, RegistryKey, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

DeviceRegistryEvents
| where ActionType == 'RegistryValueSet'
| where RegistryKey contains "SOFTWARE\\Microsoft\\Active Setup\\Installed Components"
| where RegistryValueName == 'StubPath'
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessCommandLine
| order by TimeGenerated desc
| limit 100

DeviceRegistryEvents
| where ActionType in ("SetValue","ModifyValue","RegistryValueSet","RegistryValueModified")
| where RegistryKey has "Active Setup"
| where RegistryValueName =~ "StubPath"
| project TimeGenerated,
          DeviceName,
          ActionType,
          RegistryKey,
          RegistryValueName,
          PreviousRegistryValueData,
          RegistryValueData,
          InitiatingProcessAccountName,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine
| order by TimeGenerated desc

DeviceRegistryEvents
| where RegistryValueName == "StubPath"
| where RegistryKey has "Software\\Microsoft\\Active Setup\\Installed Components"
| project TimeGenerated, DeviceName, ActionType, InitiatingProcessAccountName, InitiatingProcessCommandLine, RegistryKey, RegistryValueData
| sort by TimeGenerated desc