Investigate registry modifications on Windows that reveal when cmd.exe persistence was configured via the CommandProcessor AutoRun key. What command was configured under the AutoRun value?

DeviceRegistryEvents
| where ActionType in ("RegistryValueSet", "RegistryKeySet")
| where RegistryKey contains "Command Processor"
| where RegistryValueName =~ "AutoRun"
| project Timestamp, DeviceName, ActionType, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessCommandLine, InitiatingProcessFileName

DeviceRegistryEvents
| where ActionType in ('RegistryValueSet', 'RegistryValueCreated')
| where RegistryKey has @'Software\Microsoft\Command Processor'
| where RegistryValueName == 'AutoRun'
| project TimeGenerated, DeviceName, InitiatingProcessAccountDomain, InitiatingProcessAccountName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine

DeviceRegistryEvents
| where RegistryKey contains "\\Software\\Microsoft\\Command Processor" and RegistryValueName == "AutoRun"
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessAccountName, InitiatingProcessCommandLine

DeviceRegistryEvents
| where ActionType in~ ('RegistryValueSet','RegistryValueCreate')
| where RegistryValueName =~ 'AutoRun'
| where tolower(RegistryKey) has '\\software\\microsoft\\command processor'
   or tolower(RegistryKey) has '\\software\\wow6432node\\microsoft\\command processor'
// Identify the hive (HKLM vs user hive)
| extend rk = tolower(RegistryKey)
| extend Hive = case(
    rk startswith 'hkey_local_machine' or rk startswith 'hklm', 'HKLM',
    rk startswith 'hkey_current_user' or rk startswith 'hkcu' or rk startswith 'hkey_users' or rk startswith 'hku', 'HKCU/HKU',
    'Other')
// Latest AutoRun configuration per device + hive
| summarize arg_max(TimeGenerated,
         RegistryKey, RegistryValueData, PreviousRegistryValueData,
         InitiatingProcessAccountDomain, InitiatingProcessAccountName,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         InitiatingProcessSHA1, ActionType) by DeviceId, DeviceName, Hive
| project TimeGenerated,
          DeviceName,
          Hive,
          RegistryKey,
          AutoRunCommand = tostring(RegistryValueData),
          PreviousAutoRunCommand = tostring(PreviousRegistryValueData),
          ActionType,
          SetBy = iff(isempty(InitiatingProcessAccountDomain), InitiatingProcessAccountName, strcat(InitiatingProcessAccountDomain, '\\', InitiatingProcessAccountName)),
          SettingProcess = InitiatingProcessFileName,
          SettingProcessCommandLine = InitiatingProcessCommandLine,
          InitiatingProcessSHA1
| order by TimeGenerated desc

DeviceRegistryEvents
| where RegistryKey has_cs "\\Software\\Microsoft\\Command Processor" or RegistryKey has_cs "\\Software\\Wow6432Node\\Microsoft\\Command Processor"
| where RegistryValueName == "AutoRun"
| where ActionType in ("SetValue", "Created", "Modified", "ValueSet") or RegistryValueData != ""
| project TimeGenerated, DeviceName, DeviceId, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, RegistryKey, RegistryValueName, RegistryValueData, PreviousRegistryValueData, ActionType, ReportId
| extend AutoRunCommand = tostring(RegistryValueData)
| order by TimeGenerated desc
| take 50

DeviceRegistryEvents
| where RegistryKey has_any ("\\Software\\Microsoft\\Command Processor", "\\Command Processor")
| where RegistryValueName =~ "AutoRun"
| where RegistryKey has_any ("HKEY_CURRENT_USER", "HKCU", "HKEY_LOCAL_MACHINE", "HKLM")
| where ActionType in ("SetValue", "Create", "Modify", "Add", "ValueSet", "Delete", "Remove") or isnotempty(RegistryValueData) or isnotempty(PreviousRegistryValueData)
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, PreviousRegistryValueData, RegistryValueType, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessId, InitiatingProcessCreationTime, InitiatingProcessParentFileName, InitiatingProcessParentId, InitiatingProcessRemoteSessionIP
| order by TimeGenerated desc
| take 500

DeviceRegistryEvents
| where RegistryValueName == "AutoRun"
| where (RegistryKey contains "Command Processor") or (RegistryKey contains "CommandProcessor")
| where ActionType in ("RegistryValueModified", "RegistryValueSet", "RegistryValueUpdated", "RegistryValueCreated")
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessCreationTime, InitiatingProcessId
| sort by TimeGenerated desc

DeviceRegistryEvents
| where RegistryKey contains 'Software\\Microsoft\\Command Processor'
| where RegistryValueName == 'AutoRun'
| where ActionType == 'RegistryValueSet'
| project Timestamp, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessAccountName
| order by Timestamp desc

DeviceRegistryEvents
| where RegistryValueName == 'AutoRun'
| where RegistryKey contains 'Command Processor'
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessCommandLine
| order by TimeGenerated desc

DeviceRegistryEvents
| where ActionType =~ "RegistryValueSet" or ActionType =~ "RegistryValueModified"
| where RegistryKey has "\\Microsoft\\Command Processor"    // searching for both HKLM and HKCU possible paths
| where RegistryValueName =~ "AutoRun"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, RegistryKey, RegistryValueData
| order by TimeGenerated desc

DeviceRegistryEvents
| where RegistryKey has "\\Command Processor"
| where RegistryValueName =~ "AutoRun"
| where ActionType in ("RegistryValueSet", "RegistryValueCreated", "RegistryValueModified")
| project TimeGenerated, DeviceName, ActionType, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessCommandLine
| order by TimeGenerated desc

// Investigate CommandProcessor → AutoRun persistence modifications
let cmdProcessorKeySuffixes = dynamic([
    "\\SOFTWARE\\Microsoft\\Command Processor",
    "\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor"
]);
DeviceRegistryEvents
| where RegistryKey has "Command Processor"                    // quick pre-filter
| where RegistryKey has_any(cmdProcessorKeySuffixes)             // precise match for both 32/64-bit views
| where RegistryValueName =~ "AutoRun"                           // the persistence value
| where ActionType in ("RegistryValueSet", "RegistryValueCreated", "RegistryValueModified", "RegistryKeyCreated")
| extend AutoRunCommand = tostring(RegistryValueData)
| where isnotempty(AutoRunCommand)
| extend RegistryHive = extract("^(HKLM|HKEY_LOCAL_MACHINE|HKCU|HKEY_CURRENT_USER)", 1, RegistryKey)
| project TimeGenerated,
          DeviceName,
          RegistryHive,
          RegistryKey,
          RegistryValueName,
          AutoRunCommand,
          ActionType,
          InitiatingProcessAccountDomain,
          InitiatingProcessAccountName,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine
| order by TimeGenerated desc

DeviceRegistryEvents
| where RegistryKey contains "Command Processor" and RegistryValueName == "AutoRun"
| where isnotempty(RegistryValueData)
| project TimeGenerated, DeviceName, RegistryValueData, InitiatingProcessCommandLine, ActionType
| sort by TimeGenerated desc

DeviceRegistryEvents
| where RegistryValueName =~ "AutoRun"
| where RegistryKey contains "Command Processor"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, RegistryKey, RegistryValueData, ActionType
| order by TimeGenerated desc