Question Analysis

DeviceRegistryEvents | where ActionType == "RegistryValueSet" | where RegistryKey contains "WindowsFirewall" | project Timestamp, DeviceName, InitiatingProcessCommandLine, RegistryKey, RegistryValueName, PreviousRegistryValueData, RegistryValueData, ActionType

DeviceRegistryEvents | where ActionType == 'RegistryValueSet' | where RegistryKey has 'WindowsFirewall' | project RegistryValueName, RegistryKey, RegistryValueData, Timestamp | summarize arg_max(Timestamp, *) by RegistryValueName, RegistryKey // This helps get the latest change per unique value name and key

DeviceRegistryEvents | where ActionType in ("RegistryValueSet", "RegistryValueModified") | where RegistryKey has_any ("WindowsFirewall", "FirewallPolicy") | project TimeGenerated, DeviceName, InitiatingProcessAccountName, ActionType, RegistryKey, RegistryValueName, PreviousRegistryValueData, RegistryValueData | order by TimeGenerated desc

// Investigate registry modifications that disabled Windows Firewall and return the value name that was flipped off // Time range is supplied by the hunting portal / API wrapper DeviceRegistryEvents // 1. Only registry–value changes (set / modify / delete) | where ActionType in ("RegistryValueSet", // Defender event name "RegValueModified", // legacy "RegistryKeyValueModified", // Win-10/11 "RegistryValueDeleted") // value removed ‑ also disables FW // 2. Limit to the Windows Firewall policy locations (GPO and local) | where RegistryKey has "\\WindowsFirewall" // GPO based – HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\* or RegistryKey has "\\FirewallPolicy" // Local policy – HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\* // 3. We are interested in the moment it was turned OFF – EnableFirewall == 0 or value removed | extend NewValue = tostring(RegistryValueData), OldValue = tostring(PreviousRegistryValueData) | where RegistryValueName =~ "EnableFirewall" // the switch for every profile (Domain / Private / Public) and (NewValue == "0" or isnull(NewValue) or NewValue == "") // 4. (Optional) make sure it was previously on | where isempty(OldValue) or OldValue !in ("0", "False", "Off") // 5. Return a single event per device/profile with the data we care about | summarize LastTimeDisabled = arg_max(TimeGenerated, *) by DeviceId, RegistryKey | project LastTimeDisabled, // when it was switched off DeviceName, RegistryPath = RegistryKey, DisabledBy = strcat(InitiatingProcessAccountDomain, "\\", InitiatingProcessAccountName), Process = InitiatingProcessFileName, ProcessCmd = InitiatingProcessCommandLine, NewValue, OldValue, RegistryValueName // 6. If you only need the value-name that was flipped, uncomment the next line // | summarize by RegistryValueName