Question Analysis

DeviceRegistryEvents | where ActionType == "RegistryValueSet" | where RegistryKey contains @"Policies\System" | project Timestamp, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, ActionType

DeviceRegistryEvents | where tolower(RegistryKey) has @"policies\system" | where ActionType in ("SetValue", "ModifyValue", "ValueModified", "RegistryValueSet") | where tolower(RegistryValueName) == "shutdownwithoutlogon" | project TimeGenerated, DeviceName, InitiatingProcessAccountName, RegistryKey, RegistryValueName, RegistryValueData, ActionType

DeviceRegistryEvents | where ActionType in ("RegistryValueSet", "RegistryValueModified") // System policies locations | where RegistryKey has_any ("\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", "\\Policies\\Microsoft\\Windows\\System") // Value that controls the shutdown button on the logon screen | where RegistryValueName =~ "ShutdownWithoutLogon" // Detect it being set to 0 (disabled) | extend NewValDec = tolong(extract(@"\d+", 0, tostring(RegistryValueData))), OldValDec = tolong(extract(@"\d+", 0, tostring(PreviousRegistryValueData))) | where NewValDec == 0 or RegistryValueData has "0x00000000" | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, PreviousRegistryValueData, RegistryValueData, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId, InitiatingProcessSHA256 | order by TimeGenerated desc

DeviceRegistryEvents | where (tolower(RegistryKey) contains "\\policies\\system" or tolower(PreviousRegistryKey) contains "\\policies\\system") | where isnotempty(RegistryValueName) or isnotempty(PreviousRegistryValueName) | extend ChangedValue = tostring(coalesce(RegistryValueName, PreviousRegistryValueName)) | extend ChangedValueLower = tolower(ChangedValue) | where ChangedValueLower matches regex @".*(shutdown|shutdownwithoutlogon|noclose|hide|power|close|remove).*" | project Timestamp, DeviceName, RegistryKey, PreviousRegistryKey, RegistryValueName, PreviousRegistryValueName, RegistryValueData, PreviousRegistryValueData, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, ActionType | order by Timestamp desc | take 200

DeviceRegistryEvents | where RegistryKey contains "\\Policies\\System" or RegistryKey contains "\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" | where ActionType in ("SetValue", "Modify", "Create", "Write", "Delete") or isnotempty(RegistryValueName) or isnotempty(RegistryValueData) | where tolower(RegistryValueName) in ("shutdownwithoutlogon","shutdownwithoutlogonui","noclose","shutdownwithoutlogon") or RegistryValueName has_cs "Shutdown" or RegistryValueName has_cs "NoClose" | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, ActionType, RegistryKey, RegistryValueName, RegistryValueType, PreviousRegistryValueData, RegistryValueData | order by TimeGenerated desc | summarize Changes = count(), PrevValues = make_set(PreviousRegistryValueData), NewValues = make_set(RegistryValueData), LatestEvent = max(TimeGenerated) by RegistryValueName, DeviceName | order by LatestEvent desc | take 50

DeviceRegistryEvents | where RegistryKey contains 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\System' or RegistryKey contains 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System' | where ActionType has_any ('Set', 'RegistryValueSet') | where RegistryValueName in~ ('NoClose', 'ShutdownWithoutLogon', 'DisableShutdown') | project Timestamp, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, PreviousRegistryValueData | order by Timestamp desc

DeviceRegistryEvents | where Timestamp >= ago(30d) | where RegistryKey has "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" | where ActionType in ("RegistryValueSet", "RegistryValueModified", "SetValue", "ModifyValue") | where RegistryValueName in~ ("DisableShutdownButton", "ShutdownWithoutLogon", "HideShutdownButton") | project TimeGenerated, DeviceName, ActionType, RegistryKey, RegistryValueName, PreviousRegistryValueData, RegistryValueData, InitiatingProcessAccountName, InitiatingProcessCommandLine | order by TimeGenerated desc

DeviceRegistryEvents | where RegistryKey has "Policies\\System" | where RegistryValueData == "0" | summarize EventCount = count() by RegistryValueName, DeviceName | order by EventCount desc

DeviceRegistryEvents | where ActionType == "RegistryValueSet" | where RegistryKey startswith "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" | summarize arg_max(TimeGenerated, *) by RegistryValueName | project TimeGenerated, DeviceName, RegistryValueName, PreviousRegistryValueData, RegistryValueData | sort by TimeGenerated desc