Question Analysis

DeviceRegistryEvents | where ActionType == "RegistryValueSet" | where RegistryKey == "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" | where RegistryValueName == "PromptOnSecureDesktop" | where RegistryValueData == "0" | project Timestamp, DeviceName, InitiatingProcessCommandLine, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessAccountName

DeviceRegistryEvents | where RegistryValueData == '0' | summarize count() by RegistryValueName

DeviceRegistryEvents | where ActionType == 'RegistryValueSet' and RegistryValueData == '0' and RegistryKey contains 'Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System' | project DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RegistryKey, RegistryValueName, RegistryValueData, TimeGenerated

DeviceRegistryEvents | where RegistryValueData =~ "0" | distinct RegistryValueName | order by RegistryValueName asc

DeviceRegistryEvents | where RegistryValueData == "0" | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessAccountName, InitiatingProcessCommandLine | sort by TimeGenerated desc

let zeroRegex = @"(?i)^\s*(0|0x0+)\s*(\(\s*0\s*\))?\s*$"; DeviceRegistryEvents | where ActionType in~ ("RegistryValueSet", "RegistryValueCreated") // UAC policy path where PromptOnSecureDesktop resides | where RegistryKey has @"\Microsoft\Windows\CurrentVersion\Policies\System" and RegistryKey has_any ("HKLM\\", "HKEY_LOCAL_MACHINE\\") | extend IsZeroNow = tostring(RegistryValueData) matches regex zeroRegex, WasZeroBefore = iff(isnotempty(PreviousRegistryValueData) and tostring(PreviousRegistryValueData) matches regex zeroRegex, true, false) | where IsZeroNow and (isempty(PreviousRegistryValueData) or WasZeroBefore == false) // Optional: uncomment to focus strictly on the secure desktop setting // | where RegistryValueName =~ "PromptOnSecureDesktop" | project TimeGenerated, DeviceName, DeviceId, RegistryKey, RegistryValueName, RegistryValueType, PreviousRegistryValueData, RegistryValueData, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine | order by TimeGenerated desc

DeviceRegistryEvents | where RegistryKey has_cs "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" | where RegistryValueName in ("PromptOnSecureDesktop", "ConsentPromptBehaviorAdmin", "ConsentPromptBehaviorUser") or RegistryValueName has "PromptOnSecure" | where tostring(RegistryValueData) has "0" | project TimeGenerated, DeviceName, DeviceId, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessCommandLine, InitiatingProcessFileName, RegistryKey, RegistryValueName, RegistryValueType, RegistryValueData, PreviousRegistryValueName, PreviousRegistryValueData, InitiatingProcessId, ReportId | order by TimeGenerated desc

DeviceRegistryEvents | where TimeGenerated between (startofday(now(-30d)) .. now()) // Accept multiple representations of 0: plain "0", hex "0x0", or numeric 0 | where RegistryValueData in ("0", "0x0") or toint(RegistryValueData) == 0 // Registry path filters: HKLM (Machine) or HKCU (User) policies System key | where RegistryKey has_cs "Microsoft\\Windows\\CurrentVersion\\Policies\\System" or RegistryKey has_cs "CurrentVersion\\Policies\\System" // Value name filters: known UAC related values and common substrings | where RegistryValueName in ("PromptOnSecureDesktop", "ConsentPromptBehaviorAdmin", "ConsentPromptBehaviorUser", "EnableLUA", "EnableVirtualization") or RegistryValueName has_cs "Consent" or RegistryValueName has_cs "Prompt" or RegistryValueName has_cs "Secure" // Show previous values if present to see what changed | project TimeGenerated, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessFileName, InitiatingProcessCommandLine, RegistryKey, RegistryValueName, RegistryValueData, RegistryValueType, PreviousRegistryValueName, PreviousRegistryValueData, ReportId | order by TimeGenerated desc | take 500

DeviceRegistryEvents | where TimeGenerated >= ago(1d) | where ActionType in ("RegistryValueSet","RegistryValueUpdated","ValueSet","ValueChanged","SetValue") | extend RegValInt = todouble(RegistryValueData) | where isnotempty(RegistryValueName) and (isnotnull(RegValInt) and RegValInt == 0) | project TimeGenerated, DeviceName, DeviceId, RegistryKey, RegistryValueName, RegistryValueData, PreviousRegistryValueName, InitiatingProcessFileName, InitiatingProcessCreationTime | sort by TimeGenerated desc

DeviceRegistryEvents | where RegistryKey contains 'Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System' | where RegistryValueName == 'PromptOnSecureDesktop' | where RegistryValueData == '0' or PreviousRegistryValueData == '0' | project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RegistryKey, RegistryValueName, RegistryValueData, PreviousRegistryValueData | order by Timestamp desc

DeviceRegistryEvents | where RegistryValueData == '0' | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName | order by TimeGenerated desc

DeviceRegistryEvents | where ActionType in ("ModifyValue", "RegistryValueSet", "RegistryValueModified") | where RegistryValueData == "0" | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, PreviousRegistryValueData, RegistryValueData, InitiatingProcessAccountName, InitiatingProcessAccountDomain | order by TimeGenerated desc

DeviceRegistryEvents | where ActionType in ("RegistryValueSet", "RegistryValueModified") | where RegistryValueData == "0" | project TimeGenerated, DeviceId, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName | order by TimeGenerated desc

DeviceRegistryEvents // --- The secure-desktop policy lives here --- | where RegistryKey has "\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" // Focus on write operations | where ActionType in~ ("SetValue", "RegistryValueSet", "ModifyValue", "Modification", "UpdatedValue") // We care about values that were set TO 0 | where RegistryValueData == "0" // If we have the previous value and it was already 0 we can ignore – we want real changes | where isnull(PreviousRegistryValueData) or PreviousRegistryValueData !in ("0", "0x0") // Limit to numeric types typically used for this policy (DWORD/QWORD) when the info is present | where isnull(RegistryValueType) or RegistryValueType in~ ("REG_DWORD", "REG_QWORD", "dword", "qword") // Add a friendly user column | extend InitiatingUser = iif(isempty(InitiatingProcessAccountDomain), InitiatingProcessAccountName, strcat(InitiatingProcessAccountDomain, "\\", InitiatingProcessAccountName)) // Surface the interesting information | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, PreviousRegistryValueData, RegistryValueData, InitiatingUser, InitiatingProcessCommandLine, InitiatingProcessFileName, InitiatingProcessId, ReportId // Summarise to answer the core question – which value names were set to 0 and where/when | summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Devices=make_set(DeviceName, 10), Users=make_set(InitiatingUser, 10), ExampleProcesses=make_set(InitiatingProcessFileName, 10) by RegistryKey, RegistryValueName | order by LastSeen desc

DeviceRegistryEvents | where RegistryValueData == "0" | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessAccountName, ActionType | order by TimeGenerated desc

DeviceRegistryEvents | where RegistryValueData == "0" // Optionally filter for the specific registry key related to secure desktop elevation prompt | where RegistryKey has "Policies\\System" | where RegistryValueName == "PromptOnSecureDesktop" | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessAccountName, InitiatingProcessCommandLine | order by TimeGenerated desc

DeviceRegistryEvents | where RegistryKey startswith @"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" or RegistryKey startswith @"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\System" | where ActionType == "RegistryValueSet" | where RegistryValueData == "0" | project TimeGenerated, DeviceName, InitiatingProcessAccountDomain, InitiatingProcessAccountName, RegistryKey, RegistryValueName, RegistryValueType, RegistryValueData, PreviousRegistryValueData, InitiatingProcessCommandLine | order by TimeGenerated desc