Question Analysis

DeviceRegistryEvents | where ActionType == 'RegistryValueSet' | where RegistryKey has 'Policies\\System' and (InitiatingProcessCommandLine has 'cmd.exe' or InitiatingProcessCommandLine has 'powershell.exe') | project DeviceName, InitiatingProcessAccountName, RegistryKey, RegistryValueName, InitiatingProcessCommandLine, TimeGenerated

DeviceRegistryEvents | where RegistryKey endswith @"\Software\Microsoft\Windows\CurrentVersion\Policies\System" or RegistryKey endswith @"\Policies\System" | where (tolower(RegistryValueName) == "disablelockworkstation") and tolower(RegistryValueType) == "dword" | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueType, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine

DeviceRegistryEvents | where RegistryKey has "CurrentVersion\\Policies\\System" | summarize by RegistryValueName

let cmdline_tools = dynamic(["reg.exe","cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe"]); DeviceRegistryEvents | where ActionType == "RegistryValueSet" | where tolower(RegistryKey) has "\\software\\microsoft\\windows\\currentversion\\policies\\system" | where RegistryKey startswith "HKEY_USERS" or RegistryKey startswith "HKEY_CURRENT_USER" or RegistryKey startswith "HKU" or RegistryKey startswith "HKCU" | where tostring(RegistryValueType) contains "DWORD" | where tolower(InitiatingProcessFileName) in (cmdline_tools) or InitiatingProcessCommandLine has_any ("reg add","Set-ItemProperty","New-ItemProperty") | summarize LastSeen=max(TimeGenerated) by DeviceId, DeviceName, InitiatingProcessAccountName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine | order by LastSeen desc | project RegistryValueName | distinct RegistryValueName

DeviceRegistryEvents | where RegistryKey has 'Policies\\System' or RegistryKey has 'Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System' | where tolower(RegistryValueType) contains 'dword' | where ( InitiatingProcessCommandLine has 'reg ' or InitiatingProcessCommandLine has 'reg.exe' or InitiatingProcessCommandLine has 'reg add' or InitiatingProcessCommandLine has 'New-ItemProperty' or InitiatingProcessCommandLine has 'Set-ItemProperty' or InitiatingProcessFileName in~ ("reg.exe", "powershell.exe", "cmd.exe") ) | summarize Count = count(), LastSeen = max(TimeGenerated) by RegistryValueName, RegistryValueData | sort by LastSeen desc | project RegistryValueName, RegistryValueData, Count, LastSeen

DeviceRegistryEvents | where RegistryKey contains "Policies\\System" | where InitiatingProcessCommandLine has_any ("cmd.exe", "powershell", "reg.exe") | where isnotempty(RegistryValueName) | summarize Count = count() by RegistryValueName, RegistryKey | order by Count desc | take 1 | project RegistryValueName, RegistryKey, Count

DeviceRegistryEvents | where RegistryKey contains 'HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System' | where RegistryValueType == 'REG_DWORD' | where ActionType == 'RegistryValueSet' | distinct RegistryValueName | summarize ModifiedValues = make_set(RegistryValueName)

// Registry value added / modified to disable the “Lock Workstation” option let TargetPath = @"\Software\Microsoft\Windows\CurrentVersion\Policies\System"; DeviceRegistryEvents | where ActionType in ("RegistryValueSet","RegistryValueModified","RegistryKeyValueSet") // HKCU path only (current user) | where RegistryKey startswith_cs "HKEY_CURRENT_USER" or RegistryKey startswith_cs "HKCU" | where RegistryKey has_cs TargetPath // Evidence that change came from a script / CLI tool | where InitiatingProcessFileName in~ ("reg.exe","powershell.exe","cmd.exe","regini.exe","regedit.exe") or InitiatingProcessCommandLine has_any ("reg add","New-ItemProperty","Set-ItemProperty") // Answer: which value name(s) were changed? | summarize LastWrite = arg_max(TimeGenerated, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, RegistryKey) by RegistryValueName, DeviceName | project LastWrite, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, RegistryKey, RegistryValueName, RegistryValueData | order by LastWrite desc

DeviceRegistryEvents | where RegistryKey has "Policies\\System" | where RegistryValueType has "DWORD" | where isnotempty(InitiatingProcessCommandLine) | distinct RegistryValueName

DeviceRegistryEvents | where ActionType == "RegistryValueSet" // Only DWORD-type value changes | where RegistryValueType has "DWORD" // Target the current user Policies\System key (where DisableLockWorkstation is stored) | where RegistryKey has @"\Software\Microsoft\Windows\CurrentVersion\Policies\System" // Detect use of reg.exe (reg add) for the modification | where InitiatingProcessFileName has_cs "reg.exe" or InitiatingProcessCommandLine has_cs "reg add" // Return the registry value name and related context | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, RegistryKey, RegistryValueName, RegistryValueData | order by TimeGenerated desc