// question
Investigate Windows registry events to identify any newly set ProxyServer entry under the user Internet Settings hive. What proxy server address was configured?
Reference KQL answer and model-by-model comparison.
d88a3d3b-d016-4939-a745-03638aafd21b
question id
13/23
models correct
1
valid answer
57%
success rate
// reference answer
Human-validated correct answer for this question.
proxy.atomic-test.com:8080
// model comparison
| Model | Answer | KQL query | Status | Tries | Time | Cost |
|---|---|---|---|---|---|---|
| gemini-2.5-flash-preview-04-17 | proxy.atomic-test.com:8080 | DeviceRegistryEvents | where ActionType == 'RegistryValueSet' | where RegistryValueName == 'ProxyServer' | where RegistryKey contains @'Software\Microsoft\Windows\CurrentVersion\Internet Settings' | project Timestamp, DeviceName, InitiatingProcessAccountName, RegistryKey, RegistryValueName, RegistryValueData | pass | 2 | 16.34s | 0.0073 |
| gpt-35-turbo | no answer | no query generated | fail | 5 | 0.00s | 0.0111 |
| gpt-4-turbo-2024-04-09 | proxy.atomic-test.com:8080 | DeviceRegistryEvents | where ActionType == 'RegistryValueSet' | where RegistryKey contains 'Internet Settings' and RegistryValueName == 'ProxyServer' | project DeviceId, DeviceName, TimeGenerated, RegistryKey, RegistryValueName, RegistryValueData | pass | 2 | 14.30s | 0.0956 |
| gpt-4.1 | no answer | no query generated | fail | 5 | 0.00s | 0.0387 |
| gpt-4.1-finetuned | no answer | no query generated | fail | 5 | 0.00s | 0.0344 |
| gpt-4.1-mini | no answer | no query generated | fail | 5 | 0.00s | 0.0062 |
| gpt-4.1-nano | no answer | no query generated | fail | 5 | 0.00s | 0.0012 |
| gpt-4o | proxy.atomic-test.com:8080 | DeviceRegistryEvents | where RegistryKey contains "Internet Settings" and RegistryValueName == "ProxyServer" | project TimeGenerated, DeviceName, DeviceId, RegistryKey, RegistryValueName, RegistryValueData | pass | 1 | 23.75s | 0.0145 |
| gpt-5-high | proxy.atomic-test.com:8080 | DeviceRegistryEvents
| where ActionType == "RegistryValueSet"
| where RegistryValueName =~ "ProxyServer"
| where tolower(RegistryKey) has "\\software\\microsoft\\windows\\currentversion\\internet settings"
| where tolower(RegistryKey) has_any ("hkey_users\\", "hku\\", "hkey_current_user\\", "hkcu\\")
// keep only newly set/changed values
| where isnull(PreviousRegistryValueData) or tostring(RegistryValueData) != tostring(PreviousRegistryValueData)
| extend UserSid = extract(@'^(?:hkey_users\\|hku\\)(S-[0-9\-]+)\\', 1, tolower(RegistryKey))
| extend ProxyServer = tostring(RegistryValueData)
// show the latest set per device/key in the selected time range
| summarize arg_max(TimeGenerated, *) by DeviceId, RegistryKey
| project TimeGenerated, DeviceName, DeviceId, UserSid, ProxyServer, RegistryKey, PreviousRegistryValueData,
InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc | pass | 2 | 178.49s | 0.0813 |
| gpt-5-mini-high | proxy.atomic-test.com:8080 | DeviceRegistryEvents
| where isnotempty(RegistryValueName)
| where tolower(RegistryValueName) == "proxyserver"
| where RegistryKey has "\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" or RegistryKey has "Internet Settings"
| where ActionType in ("RegistryValueSet", "SetValue", "Modifed", "RegSetValue", "Registry value set", "Value Set", "Set") or ActionType has "Set" or ActionType has "Write" or ActionType has "Create"
| project TimeGenerated, DeviceName, DeviceId, AccountDomain = InitiatingProcessAccountDomain, AccountName = InitiatingProcessAccountName, RegistryKey, RegistryValueName, RegistryValueData, PreviousRegistryValueData, RegistryValueType, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId, InitiatingProcessCreationTime
| extend ProxyServer = tostring(RegistryValueData)
| extend PreviousProxy = tostring(PreviousRegistryValueData)
| summarize arg_max(TimeGenerated, *) by DeviceId, AccountName, RegistryKey, ProxyServer
| project TimeGenerated, DeviceName, DeviceId, AccountDomain, AccountName, RegistryKey, ProxyServer, PreviousProxy, RegistryValueType, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId, InitiatingProcessCreationTime
| order by TimeGenerated desc
| take 100 | pass | 1 | 10.07s | 0.0031 |
| gpt-5-mini-low | no answer | no query generated | fail | 5 | 0.00s | 0.0196 |
| gpt-5-mini-medium | no answer | no query generated | fail | 5 | 0.00s | 0.0129 |
| gpt-5-nano-high | no answer | no query generated | fail | 5 | 0.00s | 0.0062 |
| gpt-5-nano-medium | proxy.atomic-test.com:8080 | DeviceRegistryEvents
| where RegistryValueName == "ProxyServer"
| where RegistryKey contains "Internet Settings"
| where ActionType in ("SetValue","RegistryValueSet","WriteValue","CreateValue")
| sort by TimeGenerated desc
| summarize arg_max(TimeGenerated, RegistryValueData, InitiatingProcessAccountName, InitiatingProcessCreationTime) by DeviceId, DeviceName, RegistryKey, RegistryValueName
| project TimeGenerated, DeviceId, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessAccountName, InitiatingProcessCreationTime | pass | 1 | 26.27s | 0.0020 |
| grok-3-beta | no answer | no query generated | fail | 5 | 0.00s | 0.0872 |
| grok-3-mini-beta | proxy.atomic-test.com:8080 | DeviceRegistryEvents | where ActionType has "RegistryValueSet" | where RegistryKey has "Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" | where RegistryValueName == "ProxyServer" | project Timestamp, DeviceName, RegistryKey, RegistryValueName, RegistryValueData | order by Timestamp desc | pass | 2 | 23.72s | 0.0029 |
| o1-high | proxy.atomic-test.com:8080 | DeviceRegistryEvents
| where ActionType == "RegistryValueSet" or ActionType == "RegistryValueModified"
| where RegistryValueName == "ProxyServer"
| where RegistryKey has_any ("HKEY_USERS", "HKEY_CURRENT_USER", "HKCU", "HKU")
| where RegistryKey has "Internet Settings"
| project TimeGenerated,
DeviceName,
InitiatingProcessAccountDomain,
InitiatingProcessAccountName,
ActionType,
RegistryKey,
RegistryValueName,
RegistryValueData
| order by TimeGenerated desc | pass | 2 | 45.54s | 0.3401 |
| o1-low | proxy.atomic-test.com:8080 | DeviceRegistryEvents
| where ActionType in ("RegistryValueSet", "RegistryValueCreated")
| where RegistryKey has "Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings"
| where RegistryValueName == "ProxyServer"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, RegistryValueData
| order by TimeGenerated desc | pass | 1 | 23.40s | 0.1545 |
| o3-high | no answer | no query generated | fail | 5 | 0.00s | 0.0830 |
| o3-mini-high | proxy.atomic-test.com:8080 | DeviceRegistryEvents | where RegistryValueName =~ "ProxyServer" | where RegistryKey has "Internet Settings" | project TimeGenerated, DeviceName, RegistryKey, RegistryValueData, InitiatingProcessAccountName, ActionType | order by TimeGenerated desc | pass | 1 | 27.95s | 0.0079 |
| o3-mini-low | proxy.atomic-test.com:8080 | DeviceRegistryEvents
| where RegistryKey contains "Internet Settings"
| where RegistryValueName =~ "ProxyServer"
| where ActionType in ("SetValue", "RegValueSet", "RegistryValueSet")
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData
| order by TimeGenerated desc | pass | 2 | 29.08s | 0.0157 |
| o4-mini-high | proxy.atomic-test.com:8080 | DeviceRegistryEvents | where RegistryKey has @"\Software\Microsoft\Windows\CurrentVersion\Internet Settings" | where RegistryValueName == "ProxyServer" | where ActionType == "RegistryValueSet" | project TimeGenerated, DeviceName, InitiatingProcessAccountName, RegistryKey, RegistryValueName, ProxyServer = RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine | sort by TimeGenerated desc | pass | 1 | 34.93s | 0.0127 |
| o4-mini-low | proxy.atomic-test.com:8080 | DeviceRegistryEvents | where ActionType == "RegistryValueSet" | where RegistryKey has "Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" | where RegistryValueName == "ProxyServer" // Only show new or changed values | where isnull(PreviousRegistryValueData) or PreviousRegistryValueData != RegistryValueData | project TimeGenerated, DeviceName, InitiatingProcessAccountName, RegistryKey, RegistryValueData | sort by TimeGenerated desc | pass | 2 | 68.99s | 0.0251 |