Investigate Windows registry modification events to find the name of the registry value that was changed under the WindowsFirewall policy path when someone turned the firewall off.

DeviceRegistryEvents
| where ActionType == "RegistryValueSet"
| where RegistryKey contains "WindowsFirewall"
| project Timestamp, DeviceName, InitiatingProcessCommandLine, RegistryKey, RegistryValueName, PreviousRegistryValueData, RegistryValueData, ActionType

DeviceRegistryEvents
| where ActionType == 'RegistryValueSet'
| where RegistryKey has 'WindowsFirewall'
| project RegistryValueName, RegistryKey, RegistryValueData, Timestamp
| summarize arg_max(Timestamp, *) by RegistryValueName, RegistryKey  // This helps get the latest change per unique value name and key

DeviceRegistryEvents
| where ActionType in ("RegistryValueSet", "RegistryValueModified")
| where RegistryKey has_any ("WindowsFirewall", "FirewallPolicy")
| project TimeGenerated,
          DeviceName,
          InitiatingProcessAccountName,
          ActionType,
          RegistryKey,
          RegistryValueName,
          PreviousRegistryValueData,
          RegistryValueData
| order by TimeGenerated desc

// Investigate registry modifications that disabled Windows Firewall and return the value name that was flipped off
// Time range is supplied by the hunting portal / API wrapper
DeviceRegistryEvents
// 1. Only registry–value changes (set / modify / delete)
| where ActionType in ("RegistryValueSet",               // Defender event name
                       "RegValueModified",               // legacy
                       "RegistryKeyValueModified",       // Win-10/11
                       "RegistryValueDeleted")           // value removed ‑ also disables FW
// 2. Limit to the Windows Firewall policy locations (GPO and local)
| where RegistryKey has "\\WindowsFirewall"              // GPO based   – HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\*
   or RegistryKey has "\\FirewallPolicy"                 // Local policy – HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\*
// 3. We are interested in the moment it was turned OFF – EnableFirewall == 0 or value removed
| extend NewValue = tostring(RegistryValueData),
         OldValue = tostring(PreviousRegistryValueData)
| where RegistryValueName =~ "EnableFirewall"             // the switch for every profile (Domain / Private / Public)
       and (NewValue == "0" or isnull(NewValue) or NewValue == "")
// 4. (Optional) make sure it was previously on
| where isempty(OldValue) or OldValue !in ("0", "False", "Off")
// 5. Return a single event per device/profile with the data we care about
| summarize LastTimeDisabled = arg_max(TimeGenerated, *) by DeviceId, RegistryKey
| project LastTimeDisabled,               // when it was switched off
          DeviceName,
          RegistryPath   = RegistryKey,
          DisabledBy     = strcat(InitiatingProcessAccountDomain, "\\", InitiatingProcessAccountName),
          Process        = InitiatingProcessFileName,
          ProcessCmd     = InitiatingProcessCommandLine,
          NewValue,
          OldValue,
          RegistryValueName
// 6. If you only need the value-name that was flipped, uncomment the next line
// | summarize by RegistryValueName