Question Analysis

DeviceRegistryEvents | where ActionType in ("RegistryValueSet", "RegistryKeySet") | where RegistryKey contains "Command Processor" | where RegistryValueName =~ "AutoRun" | project Timestamp, DeviceName, ActionType, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessCommandLine, InitiatingProcessFileName

DeviceRegistryEvents | where ActionType in ('RegistryValueSet', 'RegistryValueCreated') | where RegistryKey has @'Software\Microsoft\Command Processor' | where RegistryValueName == 'AutoRun' | project TimeGenerated, DeviceName, InitiatingProcessAccountDomain, InitiatingProcessAccountName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine

DeviceRegistryEvents | where RegistryKey contains "\\Software\\Microsoft\\Command Processor" and RegistryValueName == "AutoRun" | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessAccountName, InitiatingProcessCommandLine

DeviceRegistryEvents | where ActionType in~ ('RegistryValueSet','RegistryValueCreate') | where RegistryValueName =~ 'AutoRun' | where tolower(RegistryKey) has '\\software\\microsoft\\command processor' or tolower(RegistryKey) has '\\software\\wow6432node\\microsoft\\command processor' // Identify the hive (HKLM vs user hive) | extend rk = tolower(RegistryKey) | extend Hive = case( rk startswith 'hkey_local_machine' or rk startswith 'hklm', 'HKLM', rk startswith 'hkey_current_user' or rk startswith 'hkcu' or rk startswith 'hkey_users' or rk startswith 'hku', 'HKCU/HKU', 'Other') // Latest AutoRun configuration per device + hive | summarize arg_max(TimeGenerated, RegistryKey, RegistryValueData, PreviousRegistryValueData, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessSHA1, ActionType) by DeviceId, DeviceName, Hive | project TimeGenerated, DeviceName, Hive, RegistryKey, AutoRunCommand = tostring(RegistryValueData), PreviousAutoRunCommand = tostring(PreviousRegistryValueData), ActionType, SetBy = iff(isempty(InitiatingProcessAccountDomain), InitiatingProcessAccountName, strcat(InitiatingProcessAccountDomain, '\\', InitiatingProcessAccountName)), SettingProcess = InitiatingProcessFileName, SettingProcessCommandLine = InitiatingProcessCommandLine, InitiatingProcessSHA1 | order by TimeGenerated desc

DeviceRegistryEvents | where RegistryKey has_cs "\\Software\\Microsoft\\Command Processor" or RegistryKey has_cs "\\Software\\Wow6432Node\\Microsoft\\Command Processor" | where RegistryValueName == "AutoRun" | where ActionType in ("SetValue", "Created", "Modified", "ValueSet") or RegistryValueData != "" | project TimeGenerated, DeviceName, DeviceId, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, RegistryKey, RegistryValueName, RegistryValueData, PreviousRegistryValueData, ActionType, ReportId | extend AutoRunCommand = tostring(RegistryValueData) | order by TimeGenerated desc | take 50

DeviceRegistryEvents | where RegistryKey has_any ("\\Software\\Microsoft\\Command Processor", "\\Command Processor") | where RegistryValueName =~ "AutoRun" | where RegistryKey has_any ("HKEY_CURRENT_USER", "HKCU", "HKEY_LOCAL_MACHINE", "HKLM") | where ActionType in ("SetValue", "Create", "Modify", "Add", "ValueSet", "Delete", "Remove") or isnotempty(RegistryValueData) or isnotempty(PreviousRegistryValueData) | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, PreviousRegistryValueData, RegistryValueType, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessId, InitiatingProcessCreationTime, InitiatingProcessParentFileName, InitiatingProcessParentId, InitiatingProcessRemoteSessionIP | order by TimeGenerated desc | take 500

DeviceRegistryEvents | where RegistryValueName == "AutoRun" | where (RegistryKey contains "Command Processor") or (RegistryKey contains "CommandProcessor") | where ActionType in ("RegistryValueModified", "RegistryValueSet", "RegistryValueUpdated", "RegistryValueCreated") | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessCreationTime, InitiatingProcessId | sort by TimeGenerated desc

DeviceRegistryEvents | where RegistryKey contains 'Software\\Microsoft\\Command Processor' | where RegistryValueName == 'AutoRun' | where ActionType == 'RegistryValueSet' | project Timestamp, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessAccountName | order by Timestamp desc

DeviceRegistryEvents | where RegistryValueName == 'AutoRun' | where RegistryKey contains 'Command Processor' | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessCommandLine | order by TimeGenerated desc

DeviceRegistryEvents | where ActionType =~ "RegistryValueSet" or ActionType =~ "RegistryValueModified" | where RegistryKey has "\\Microsoft\\Command Processor" // searching for both HKLM and HKCU possible paths | where RegistryValueName =~ "AutoRun" | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, RegistryKey, RegistryValueData | order by TimeGenerated desc

DeviceRegistryEvents | where RegistryKey has "\\Command Processor" | where RegistryValueName =~ "AutoRun" | where ActionType in ("RegistryValueSet", "RegistryValueCreated", "RegistryValueModified") | project TimeGenerated, DeviceName, ActionType, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessCommandLine | order by TimeGenerated desc

// Investigate CommandProcessor → AutoRun persistence modifications let cmdProcessorKeySuffixes = dynamic([ "\\SOFTWARE\\Microsoft\\Command Processor", "\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor" ]); DeviceRegistryEvents | where RegistryKey has "Command Processor" // quick pre-filter | where RegistryKey has_any(cmdProcessorKeySuffixes) // precise match for both 32/64-bit views | where RegistryValueName =~ "AutoRun" // the persistence value | where ActionType in ("RegistryValueSet", "RegistryValueCreated", "RegistryValueModified", "RegistryKeyCreated") | extend AutoRunCommand = tostring(RegistryValueData) | where isnotempty(AutoRunCommand) | extend RegistryHive = extract("^(HKLM|HKEY_LOCAL_MACHINE|HKCU|HKEY_CURRENT_USER)", 1, RegistryKey) | project TimeGenerated, DeviceName, RegistryHive, RegistryKey, RegistryValueName, AutoRunCommand, ActionType, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine | order by TimeGenerated desc

DeviceRegistryEvents | where RegistryKey contains "Command Processor" and RegistryValueName == "AutoRun" | where isnotempty(RegistryValueData) | project TimeGenerated, DeviceName, RegistryValueData, InitiatingProcessCommandLine, ActionType | sort by TimeGenerated desc

DeviceRegistryEvents | where RegistryValueName =~ "AutoRun" | where RegistryKey contains "Command Processor" | project TimeGenerated, DeviceName, InitiatingProcessAccountName, RegistryKey, RegistryValueData, ActionType | order by TimeGenerated desc