A Windows user’s registry was altered via a command-line tool to disable the lock workstation feature by adding a DWORD entry under the current user Policies\System key. Which registry value name was modified in this operation?

DeviceRegistryEvents
| where ActionType == 'RegistryValueSet'
| where RegistryKey has 'Policies\\System' and (InitiatingProcessCommandLine has 'cmd.exe' or InitiatingProcessCommandLine has 'powershell.exe')
| project DeviceName, InitiatingProcessAccountName, RegistryKey, RegistryValueName, InitiatingProcessCommandLine, TimeGenerated

DeviceRegistryEvents
| where RegistryKey endswith @"\Software\Microsoft\Windows\CurrentVersion\Policies\System"
      or RegistryKey endswith @"\Policies\System"
| where (tolower(RegistryValueName) == "disablelockworkstation")
      and tolower(RegistryValueType) == "dword"
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueType, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine

DeviceRegistryEvents
| where RegistryKey has "CurrentVersion\\Policies\\System"
| summarize by RegistryValueName

let cmdline_tools = dynamic(["reg.exe","cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe"]);
DeviceRegistryEvents
| where ActionType == "RegistryValueSet"
| where tolower(RegistryKey) has "\\software\\microsoft\\windows\\currentversion\\policies\\system"
| where RegistryKey startswith "HKEY_USERS" or RegistryKey startswith "HKEY_CURRENT_USER" or RegistryKey startswith "HKU" or RegistryKey startswith "HKCU"
| where tostring(RegistryValueType) contains "DWORD"
| where tolower(InitiatingProcessFileName) in (cmdline_tools) or InitiatingProcessCommandLine has_any ("reg add","Set-ItemProperty","New-ItemProperty")
| summarize LastSeen=max(TimeGenerated) by DeviceId, DeviceName, InitiatingProcessAccountName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by LastSeen desc
| project RegistryValueName
| distinct RegistryValueName

DeviceRegistryEvents
| where RegistryKey has 'Policies\\System' or RegistryKey has 'Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System'
| where tolower(RegistryValueType) contains 'dword'
| where (
    InitiatingProcessCommandLine has 'reg ' or
    InitiatingProcessCommandLine has 'reg.exe' or
    InitiatingProcessCommandLine has 'reg add' or
    InitiatingProcessCommandLine has 'New-ItemProperty' or
    InitiatingProcessCommandLine has 'Set-ItemProperty' or
    InitiatingProcessFileName in~ ("reg.exe", "powershell.exe", "cmd.exe")
)
| summarize Count = count(), LastSeen = max(TimeGenerated) by RegistryValueName, RegistryValueData
| sort by LastSeen desc
| project RegistryValueName, RegistryValueData, Count, LastSeen

DeviceRegistryEvents
| where RegistryKey contains "Policies\\System"
| where InitiatingProcessCommandLine has_any ("cmd.exe", "powershell", "reg.exe")
| where isnotempty(RegistryValueName)
| summarize Count = count() by RegistryValueName, RegistryKey
| order by Count desc
| take 1
| project RegistryValueName, RegistryKey, Count

DeviceRegistryEvents
| where RegistryKey contains 'HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System'
| where RegistryValueType == 'REG_DWORD'
| where ActionType == 'RegistryValueSet'
| distinct RegistryValueName
| summarize ModifiedValues = make_set(RegistryValueName)

// Registry value added / modified to disable the “Lock Workstation” option
let TargetPath = @"\Software\Microsoft\Windows\CurrentVersion\Policies\System";
DeviceRegistryEvents
| where ActionType in ("RegistryValueSet","RegistryValueModified","RegistryKeyValueSet")
// HKCU path only (current user)
| where RegistryKey startswith_cs "HKEY_CURRENT_USER" or RegistryKey startswith_cs "HKCU"
| where RegistryKey has_cs TargetPath
// Evidence that change came from a script / CLI tool
| where InitiatingProcessFileName in~ ("reg.exe","powershell.exe","cmd.exe","regini.exe","regedit.exe")
        or InitiatingProcessCommandLine has_any ("reg add","New-ItemProperty","Set-ItemProperty")
// Answer: which value name(s) were changed?
| summarize LastWrite = arg_max(TimeGenerated, RegistryValueData, InitiatingProcessFileName,
                                InitiatingProcessCommandLine, InitiatingProcessAccountName,
                                RegistryKey) by RegistryValueName, DeviceName
| project LastWrite, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName,
          InitiatingProcessCommandLine, RegistryKey, RegistryValueName, RegistryValueData
| order by LastWrite desc

DeviceRegistryEvents
| where RegistryKey has "Policies\\System"
| where RegistryValueType has "DWORD"
| where isnotempty(InitiatingProcessCommandLine)
| distinct RegistryValueName

DeviceRegistryEvents
| where ActionType == "RegistryValueSet"
// Only DWORD-type value changes
| where RegistryValueType has "DWORD"
// Target the current user Policies\System key (where DisableLockWorkstation is stored)
| where RegistryKey has @"\Software\Microsoft\Windows\CurrentVersion\Policies\System"
// Detect use of reg.exe (reg add) for the modification
| where InitiatingProcessFileName has_cs "reg.exe" or InitiatingProcessCommandLine has_cs "reg add"
// Return the registry value name and related context
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, RegistryKey, RegistryValueName, RegistryValueData
| order by TimeGenerated desc