A Windows host shows a registry write under DeviceRegistryEvents affecting the System policy path. Investigate entries where the data is set to ‘0’ and determine which registry value was modified to turn off UAC consent prompts.

DeviceRegistryEvents
| where ActionType startswith "RegistryValueSet"
| where RegistryKey contains "Policies\\System"
| where RegistryValueData == "0"
| project Timestamp, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessCommandLine, InitiatingProcessFileName
| order by Timestamp

DeviceRegistryEvents | where RegistryValueData == '0' and RegistryKey contains 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System'

DeviceRegistryEvents
| where ActionType == 'RegistryValueSet'
| where RegistryKey has 'SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System' and RegistryValueData == '0'
| project DeviceName, InitiatingProcessAccountName, RegistryKey, RegistryValueName, RegistryValueData, TimeGenerated

DeviceRegistryEvents
| where ActionType == "RegistryValueSet"
| where RegistryKey has "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
| where RegistryValueData == "0"
| where RegistryValueName in ("ConsentPromptBehaviorAdmin", "EnableLUA", "PromptOnSecureDesktop", "ConsentPromptBehaviorUser")
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessAccountName, InitiatingProcessCommandLine, InitiatingProcessFileName

DeviceRegistryEvents
| where RegistryKey contains "\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
| where RegistryValueData == "0"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

DeviceRegistryEvents
| where RegistryKey contains "System" and RegistryValueData == "0"
| project DeviceId, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, TimeGenerated, InitiatingProcessAccountName, InitiatingProcessCommandLine

DeviceRegistryEvents
| where ActionType == "RegistryValueSet"
// System policy path
| where RegistryKey has_cs "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
// Normalize and match data set to 0 (covers common DWORD renderings)
| extend RegData = trim(@"\s", tostring(RegistryValueData))
| extend RegDataLower = tolower(RegData)
| where RegDataLower in ("0", "00000000", "0x00000000")
// Classify UAC-related impact
| extend UACSetting = case(
        RegistryValueName =~ "EnableLUA", "EnableLUA=0 disables UAC entirely (no consent prompts; reboot required)",
        RegistryValueName =~ "ConsentPromptBehaviorAdmin", "ConsentPromptBehaviorAdmin=0 elevates without prompting (no UAC consent prompts for admins)",
        RegistryValueName =~ "ConsentPromptBehaviorUser", "ConsentPromptBehaviorUser=0 automatically denies elevation (no prompts shown to standard users)",
        RegistryValueName =~ "PromptOnSecureDesktop", "PromptOnSecureDesktop=0 shows prompts on normal desktop (not secure)",
        "Other"
    )
| extend TurnsOffUACConsentPrompts = iif(RegistryValueName in~ ("EnableLUA", "ConsentPromptBehaviorAdmin"), true, false)
| project TimeGenerated, DeviceName, DeviceId, RegistryKey, RegistryValueName, RegistryValueData,
          PreviousRegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine,
          InitiatingProcessAccountDomain, InitiatingProcessAccountName, UACSetting, TurnsOffUACConsentPrompts
| order by TimeGenerated desc

DeviceRegistryEvents
| where isnotempty(RegistryKey)
| extend key_lc = tolower(RegistryKey)
// Match policy/System paths controlling UAC/Consent prompts (use contains to avoid escaping issues)
| where key_lc contains "policies" and key_lc contains "system"
// Filter for write actions - common ActionType values vary by connector/version
| where tolower(ActionType) contains "set" or tolower(ActionType) contains "create" or tolower(ActionType) contains "modify" or tolower(ActionType) contains "write"
// Normalize RegistryValueData and match 0 (string or common hex forms)
| extend rvdata = trim(" ", tostring(RegistryValueData))
| where rvdata in ("0", "0x00000000", "0x0", "0x00000000;", "0;")
// Normalize RegistryValueName
| extend rvn_lc = tolower(tostring(RegistryValueName))
// Known UAC-related value names and keywords
| where rvn_lc in ("consentpromptbehavioradmin","consentpromptbehavioruser","consentpromptbehaviordesktopuser","consentpromptbehaviorsecuredesktop","enablelua","enablesecureuacmode","filteradministratorstoken","localaccounttokenfilterpolicy","promptonsecuredesktop","behaviorinadmininstall")
    or rvn_lc contains "consent" or rvn_lc contains "uac" or rvn_lc contains "prompt" or rvn_lc contains "secure" or rvn_lc contains "filter" or rvn_lc contains "enable"
// Only show actual change where previous value differs (optional)
| where coalesce(tostring(PreviousRegistryValueData), "") != rvdata
| project TimeGenerated, DeviceName, DeviceId, ReportId, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId, ActionType, RegistryKey, RegistryValueName, RegistryValueType, RegistryValueData, PreviousRegistryValueData, PreviousRegistryKey
| order by TimeGenerated desc
| limit 200

DeviceRegistryEvents
| where tolower(ActionType) has_any ("setvalue","writevalue","valueset","registryvalueset","modify","set")
// Normalize fields
| extend RK = tolower(tostring(RegistryKey)), RVN = tolower(tostring(RegistryValueName)), RVD = tostring(RegistryValueData)
// Focus on common system policy locations that hold UAC settings
| where RK has "\\policies\\system" or RK has "\\system\\currentcontrolset\\policies\\system" or RK has "\\microsoft\\windows\\currentversion\\policies\\system" or RK has "\\system\\currentcontrolset\\control\\lsa" or RK has "software\\microsoft\\windows\\currentversion\\policies\\system"
// Match value data that represents 0 (decimal 0, hex 0, or dword:00000000 style)
| where RVD matches regex @"(?i)^\s*(?:0|0x0|dword:0+)\s*$"
// UAC-related registry value names (normalized to lower-case)
| where RVN in ("consentpromptbehavioradmin","consentpromptbehavioruser","enablelua","promptonsecuredesktop","filteradministratortoken","enableinstallerdetection")
// Keep relevant context fields (use initiating process account/name fields that exist on DeviceRegistryEvents)
| project TimeGenerated, DeviceName, DeviceId, InitiatingProcessAccountName, InitiatingProcessAccountSid, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId, RegistryKey, RegistryValueName, RegistryValueData, PreviousRegistryValueData, ActionType, ReportId
// Summarize for easier triage
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Count=count(), AnyProcess=any(InitiatingProcessFileName), AnyCmdLine=any(InitiatingProcessCommandLine), InitiatingAccounts=make_set(InitiatingProcessAccountName) by DeviceName, DeviceId, RegistryKey, RegistryValueName, RegistryValueData, PreviousRegistryValueData
| order by FirstSeen desc

let defaultWindow = 24h; // default to last 24 hours; the caller may override this via timerange
DeviceRegistryEvents
| where TimeGenerated >= ago(defaultWindow)
| where RegistryKey contains "\\Policies\\System" or RegistryKey contains "Policies\\System"
| where RegistryValueData == "0"
| where RegistryValueName in ("ConsentPromptBehaviorAdmin", "ConsentPromptBehaviorUser")
| project TimeGenerated, DeviceName, InitiatingProcessAccountDomain, InitiatingProcessAccountName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessCreationTime
| sort by TimeGenerated desc

DeviceRegistryEvents
| where RegistryKey contains 'Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System'
| where RegistryValueName == 'ConsentPromptBehaviorAdmin'
| where RegistryValueData == '0'
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessAccountName, InitiatingProcessCommandLine
| order by TimeGenerated desc

DeviceRegistryEvents
| where ActionType == 'RegistryValueSet'  // Filter for registry write actions
| where RegistryKey contains 'Policies\\System'  // Target the System policy path
| where RegistryValueData == '0'  // Match entries where the data is set to '0'
| project Timestamp, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessCommandLine  // Project relevant fields for analysis
| order by Timestamp desc  // Order by timestamp for chronological review

DeviceRegistryEvents
| where ActionType == "RegistryValueSet"
| where RegistryKey has "\\Policies\\System"
| where RegistryValueData == "0"
| project TimeGenerated,
          DeviceName,
          RegistryKey,
          RegistryValueName,
          RegistryValueData,
          InitiatingProcessAccountName,
          InitiatingProcessCommandLine,
          InitiatingProcessId,
          InitiatingProcessParentFileName
| order by TimeGenerated desc

DeviceRegistryEvents
| where RegistryKey has "\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
| where isnotempty(RegistryValueData)
| where RegistryValueData == "0"
| project TimeGenerated, DeviceName, ActionType, RegistryKey, RegistryValueName, RegistryValueData,
          InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessCommandLine

DeviceRegistryEvents
// ‑-- Time range is supplied by the hunting/alert rule, no hard-coded range here ‑--
| where ActionType == "RegistryValueSet"   // only consider actual value writes
| where RegistryKey has "\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"  // UAC policy hive
| where RegistryValueData == "0"            // DWORD value set to 0
// Focus on the two knobs used to disable UAC prompts.
| where RegistryValueName in ("EnableLUA", "ConsentPromptBehaviorAdmin")
| project TimeGenerated,
          DeviceName,
          DeviceId,
          RegistryKey,
          RegistryValueName,
          RegistryValueData,
          PreviousRegistryValueData,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine,
          InitiatingProcessAccountDomain,
          InitiatingProcessAccountName,
          InitiatingProcessSHA256,
          ReportId
| order by TimeGenerated desc

DeviceRegistryEvents
| where RegistryKey has "Policies\\System"
| where RegistryValueData == "0"
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessCommandLine, InitiatingProcessAccountName
| order by TimeGenerated desc

DeviceRegistryEvents
| where RegistryKey contains "Policies\\System"
| where RegistryValueData == "0"
| summarize EventCount=count() by RegistryValueName, RegistryKey, RegistryValueData
| project RegistryValueName, RegistryKey, RegistryValueData, EventCount

DeviceRegistryEvents
| where ActionType == "RegistryValueSet"
// Only look in the System policy path where UAC settings are stored
| where RegistryKey has_cs "Policies\\System"
// Filter to known UAC-related values
| where RegistryValueName in ("EnableLUA", "ConsentPromptBehaviorAdmin", "ConsentPromptBehaviorUser", "PromptOnSecureDesktop")
// Match plain '0' or hex–encoded zeros (e.g. '0x00000000')
| where RegistryValueData matches regex "^(0|0x0+|0+)$"
// Return relevant context
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, InitiatingProcessFileName, RegistryKey, RegistryValueName, RegistryValueData
| sort by TimeGenerated desc