Evidence shows that the Windows Defender startup entry was tampered with via an elevated command prompt. Investigate registry events related to the Run key to discover which executable replaced the default SecurityHealth value. What is the name of the new program?

DeviceRegistryEvents
| where RegistryKey endswith @"\Microsoft\Windows\CurrentVersion\Run"
| where RegistryValueName == "SecurityHealth"
| where ActionType == "RegistryValueSet"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessTokenElevation, RegistryKey, RegistryValueName, RegistryValueData
| order by TimeGenerated desc

DeviceRegistryEvents
| where RegistryKey has_any ("Software\\Microsoft\\Windows\\CurrentVersion\\Run", "SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run")
| where RegistryValueName == "SecurityHealth"
| project TimeGenerated, DeviceName, RegistryValueData
| order by TimeGenerated desc
| take 1

DeviceRegistryEvents
| where RegistryKey contains "Run" and RegistryValueName == "SecurityHealth"
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, ActionType

DeviceRegistryEvents
| where ActionType == "RegistryValueSet"
// Target the Run key where the Windows Security (Defender) tray app is configured
| where RegistryKey endswith @"\Microsoft\Windows\CurrentVersion\Run"
| where RegistryValueName =~ "SecurityHealth"
// Exclude the default/legit value to surface replacements
| where RegistryValueData !has_cs "SecurityHealthSystray.exe"
// Extract the program path from the value data (handles quoted and unquoted cmdlines)
| extend NewProgramPath = coalesce(
    extract(@'^""?([^"\n]+)"', 1, tostring(RegistryValueData)), // quoted path
    extract(@'^(\S+)', 1, tostring(RegistryValueData))             // first token if unquoted
)
| extend NewProgramName = extract(@'([^\\/]+)$', 1, tostring(NewProgramPath))
| where isnotempty(NewProgramName)
// Helpful context to validate elevated cmd prompt tampering
| project TimeGenerated, DeviceName, DeviceId, RegistryKey, RegistryValueName, RegistryValueData,
          NewProgramPath, NewProgramName,
          InitiatingProcessFileName, InitiatingProcessParentFileName,
          InitiatingProcessTokenElevation, InitiatingProcessIntegrityLevel,
          InitiatingProcessCommandLine
| order by TimeGenerated desc
// If you just want the answer per device (latest change): uncomment below
// | summarize arg_max(TimeGenerated, *) by DeviceId
// | project TimeGenerated, DeviceName, NewProgramName, NewProgramPath, InitiatingProcessFileName, InitiatingProcessTokenElevation, InitiatingProcessIntegrityLevel

DeviceRegistryEvents
| where RegistryKey has "Software\\Microsoft\\Windows\\CurrentVersion\\Run"
| where RegistryValueName == "SecurityHealth"
| where ActionType startswith "Registry"
| extend NewProgram = extract(@"[^\\]+$", 0, RegistryValueData)  // Extracts the executable name from the end of the path
| project Timestamp, RegistryKey, RegistryValueName, RegistryValueData, NewProgram, InitiatingProcessFileName
| order by Timestamp desc

DeviceRegistryEvents
| where RegistryKey endswith "Microsoft\\Windows\\CurrentVersion\\Run"
| where ActionType in ("RegistryValueSet", "RegistryValueModified", "RegistryValueNameSet", "RegistryValueNameModified")
| where RegistryValueName has "SecurityHealth"
| order by TimeGenerated desc
| project TimeGenerated,
          DeviceName,
          RegistryKey,
          RegistryValueName,
          PreviousRegistryValueData,
          RegistryValueData,
          InitiatingProcessAccountName,
          InitiatingProcessCommandLine,
          InitiatingProcessFileName,
          InitiatingProcessTokenElevation

DeviceRegistryEvents
| where ActionType in ("RegistryValueSet", "RegistryValueModified")
| where RegistryKey has "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" and RegistryValueName == "SecurityHealth"
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessCommandLine
| order by TimeGenerated desc

DeviceRegistryEvents
| where RegistryKey has "Run"
| where RegistryValueName == "SecurityHealth"
| where ActionType contains "Set"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, RegistryKey, RegistryValueName, RegistryValueData
| sort by TimeGenerated desc
| extend NewProgram = tostring(split(RegistryValueData, "\\")[-1])
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RegistryKey, NewProgram