Question Analysis

DeviceRegistryEvents | where ActionType == "RegistryValueSet" | where RegistryKey contains @"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" | where RegistryValueName == "EnableLUA" | where RegistryValueData == "0" | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessFolderPath, RegistryKey, RegistryValueName, RegistryValueData

DeviceRegistryEvents | where RegistryKey == 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System' and RegistryValueName == 'EnableLUA' and RegistryValueData == '0' | project DeviceName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine

DeviceRegistryEvents | where RegistryKey has "\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" and RegistryValueName == "EnableLUA" and RegistryValueData == "0" and (ActionType == "RegistryValueSet" or ActionType == "RegistryKeyValueUpdated") | project TimeGenerated, DeviceName, DeviceId, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessParentFileName, InitiatingProcessParentId | order by TimeGenerated desc

DeviceRegistryEvents | where RegistryKey == 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System' | where RegistryValueName == 'EnableLUA' | where RegistryValueData == '0' | project TimeGenerated, DeviceName, InitiatingProcessFileName, RegistryKey, RegistryValueName, RegistryValueData | order by TimeGenerated desc

DeviceRegistryEvents | where RegistryKey endswith "\\Policies\\System" and RegistryValueName == "EnableLUA" and RegistryValueData == "0" | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName

let UacPolicyKeySuffix = "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"; DeviceRegistryEvents | where ActionType in~ ("RegistryValueSet", "RegistryValueCreate") | where RegistryKey contains UacPolicyKeySuffix | where RegistryValueName =~ "EnableLUA" // match 0 in decimal/hex/dword formats: 0, 00000000, 0x00000000, dword:00000000 | where tostring(RegistryValueData) matches regex "^(?i)(dword:)?(0x)?0+$" | extend ChangerUtility = coalesce(InitiatingProcessVersionInfoOriginalFileName, InitiatingProcessFileName, InitiatingProcessVersionInfoInternalFileName) | project TimeGenerated, DeviceId, DeviceName, ActionType, RegistryKey, RegistryValueName, RegistryValueData, PreviousRegistryValueData, ChangerUtility, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessSHA1, InitiatingProcessSHA256, InitiatingProcessVersionInfoCompanyName, InitiatingProcessVersionInfoFileDescription, InitiatingProcessParentFileName, InitiatingProcessParentId | order by TimeGenerated desc

// Find registry events that set EnableLUA to 0 under the Policies\System key DeviceRegistryEvents | where RegistryKey has_cs "Policies\\System" and RegistryValueName == "EnableLUA" and RegistryValueData == "0" | project TimeGenerated, DeviceId, DeviceName, InitiatingProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessAccountDomain, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessCreationTime // Lookup more details about the initiating process from DeviceProcessEvents | join kind=leftouter ( DeviceProcessEvents | project ProcessId = InitiatingProcessId, ProcessFileName = InitiatingProcessFileName, ProcessCommandLine = InitiatingProcessCommandLine, ProcessCreationTime = InitiatingProcessCreationTime, InitiatingProcessAccountName, InitiatingProcessAccountDomain, DeviceId, TimeGenerated ) on $left.DeviceId == $right.DeviceId and $left.InitiatingProcessId == $right.ProcessId | project TimeGenerated = coalesce(TimeGenerated, TimeGenerated1), DeviceId, DeviceName, InitiatingProcessId, InitiatingProcessFileName = coalesce(InitiatingProcessFileName, ProcessFileName), InitiatingProcessCommandLine = coalesce(InitiatingProcessCommandLine, ProcessCommandLine), InitiatingProcessCreationTime = coalesce(InitiatingProcessCreationTime, ProcessCreationTime), InitiatingProcessAccountName = coalesce(InitiatingProcessAccountName, InitiatingProcessAccountName1), InitiatingProcessAccountDomain = coalesce(InitiatingProcessAccountDomain, InitiatingProcessAccountDomain1), RegistryKey, RegistryValueName, RegistryValueData | sort by TimeGenerated desc | take 50

let targetPaths = dynamic(["system\\currentcontrolset\\policies\\system","hklm\\system\\currentcontrolset\\policies\\system","hkml\\system\\currentcontrolset\\policies\\system","software\\microsoft\\windows\\currentversion\\policies\\system"]); DeviceRegistryEvents | where tolower(RegistryKey) has_any (targetPaths) | where tolower(RegistryValueName) == "enablelua" | where tostring(RegistryValueData) == "0" or tolong(RegistryValueData) == 0 // Keep the most recent change per device/report/key/value | summarize arg_max(TimeGenerated, *) by ReportId, RegistryKey, RegistryValueName | project RegTime=TimeGenerated, DeviceId, RegDeviceName=DeviceName, ReportId, RegistryKey, RegistryValueName, RegistryValueData=tostring(RegistryValueData), PreviousRegistryValueData=tostring(PreviousRegistryValueData), ActionType, InitiatingProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessAccountSid, InitiatingProcessCreationTime, InitiatingProcessParentId, InitiatingProcessParentFileName | join kind=leftouter ( DeviceProcessEvents | project ProcReportId=ReportId, ProcId=ProcessId, ProcFileName=FileName, ProcCommandLine=ProcessCommandLine, ProcCreationTime=ProcessCreationTime, ProcAccountName=AccountName, ProcAccountDomain=AccountDomain, ProcParentFileName=InitiatingProcessParentFileName ) on $left.ReportId == $right.ProcReportId and $left.InitiatingProcessId == $right.ProcId | join kind=leftouter ( DeviceFileEvents | project FileReportId=ReportId, FileName, FolderPath, FileInitiatingProcessId=InitiatingProcessId, FileInitiatingProcessFileName=InitiatingProcessFileName ) on $left.ReportId == $right.FileReportId and $left.InitiatingProcessId == $right.FileInitiatingProcessId | extend InitiatingProcessFileName = coalesce(InitiatingProcessFileName, ProcFileName, FileName), InitiatingProcessCommandLine = coalesce(InitiatingProcessCommandLine, ProcCommandLine), InitiatingProcessAccountName = coalesce(InitiatingProcessAccountName, ProcAccountName), InitiatingProcessAccountDomain = coalesce(InitiatingProcessAccountDomain, ProcAccountDomain), InitiatingProcessCreationTime = coalesce(InitiatingProcessCreationTime, ProcCreationTime), InitiatingProcessParentFileName = coalesce(InitiatingProcessParentFileName, ProcParentFileName) | project RegTime, DeviceId, RegDeviceName, RegistryKey, RegistryValueName, RegistryValueData, PreviousRegistryValueData, ActionType, InitiatingProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessAccountSid, InitiatingProcessCreationTime, InitiatingProcessParentId, InitiatingProcessParentFileName | order by RegTime desc | take 50

// Find registry events setting EnableLUA to 0 under Policies\System and show the initiating utility DeviceRegistryEvents | where RegistryValueName has_cs "EnableLUA" // Normalize key path comparisons: Windows registry paths can be logged with or without leading backslashes | where RegistryKey has_cs "Policies\\System" or RegistryKey has_cs "\\Policies\\System" or RegistryKey has_cs "System" and RegistryKey has_cs "Policies" // RegistryValueData may be string or numeric; coalesce both | where tostring(RegistryValueData) == "0" or toint(RegistryValueData) == 0 | project TimeGenerated, DeviceName, DeviceId, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessFileName, InitiatingProcessId, InitiatingProcessCommandLine, InitiatingProcessCreationTime, RegistryKey, RegistryValueName, RegistryValueData, PreviousRegistryValueData | order by TimeGenerated desc | extend EventTime = TimeGenerated // Enrich with process details by matching initiating process id and device within a short time window | join kind=leftouter ( DeviceProcessEvents | project ProcessTime = TimeGenerated, DeviceId, ProcessId = InitiatingProcessId, ProcessFileName = FileName, ProcessCommandLine, ProcessCreationTime, ProcessSHA256 = SHA256, ProcessParentId = InitiatingProcessParentId ) on DeviceId, $left.InitiatingProcessId == $right.ProcessId | where isnull(ProcessTime) or abs(todatetime(EventTime) - todatetime(ProcessTime)) < 1m | project EventTime, DeviceName, DeviceId, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessFileName = coalesce(ProcessFileName, InitiatingProcessFileName), InitiatingProcessId, InitiatingProcessCommandLine = coalesce(ProcessCommandLine, InitiatingProcessCommandLine), ProcessCreationTime = coalesce(ProcessCreationTime, InitiatingProcessCreationTime), ProcessSHA256, ProcessParentId, RegistryKey, RegistryValueName, RegistryValueData, PreviousRegistryValueData | order by EventTime desc

DeviceRegistryEvents | where RegistryKey contains "Policies" and RegistryKey contains "System" | where RegistryValueName == "EnableLUA" and RegistryValueData == "0" | project TimeGenerated, DeviceName, DeviceId, InitiatingProcessFileName, InitiatingProcessCommandLine, RegistryKey, RegistryValueName, RegistryValueData | extend RegUtility = iif(InitiatingProcessFileName contains "reg.exe", "reg.exe", iif(InitiatingProcessFileName contains "regedit.exe", "regedit.exe", iif(InitiatingProcessCommandLine contains "reg add", "Command: reg add", "Other"))) | sort by TimeGenerated desc | take 100

DeviceRegistryEvents | where RegistryKey endswith "\\Policies\\System" and RegistryValueName == "EnableLUA" | where toint(RegistryValueData) == 0 | project TimeGenerated, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessCreationTime | summarize ChangeCount = count() by InitiatingProcessFileName, InitiatingProcessCommandLine | sort by ChangeCount desc

DeviceRegistryEvents | where RegistryKey contains 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System' | where RegistryValueName == 'EnableLUA' and RegistryValueData == '0' | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RegistryKey, RegistryValueName, RegistryValueData | order by Timestamp desc

DeviceRegistryEvents | where RegistryValueName == 'EnableLUA' and RegistryValueData == '0' and RegistryKey contains 'Policies' and RegistryKey contains 'System' | project Timestamp, DeviceName, InitiatingProcessFileName, RegistryKey, RegistryValueData | order by Timestamp desc | summarize Utility=make_set(InitiatingProcessFileName) by DeviceName

DeviceRegistryEvents | where ActionType == "RegistryValueSet" | where RegistryKey =~ "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" | where RegistryValueName =~ "EnableLUA" | where RegistryValueData == "0" | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessVersionInfoOriginalFileName, InitiatingProcessVersionInfoFileDescription | order by TimeGenerated desc

DeviceRegistryEvents | where ActionType in ("ModifyValue", "RegistryValueSet", "SetValue") | where RegistryKey has "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" | where RegistryValueName == "EnableLUA" | where RegistryValueData == "0" | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessVersionInfoCompanyName, InitiatingProcessVersionInfoProductName, InitiatingProcessVersionInfoOriginalFileName | order by TimeGenerated desc

DeviceRegistryEvents // 1. Registry write operations that could modify a value | where ActionType in ("RegistryValueSet", "RegistryKeyValueSet", "SetValue", "Modify") // 2. Target the UAC switch-off location: HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA | where RegistryKey has "\\Windows\\CurrentVersion\\Policies\\System" | where RegistryValueName =~ "EnableLUA" | where tolower(tostring(RegistryValueData)) in ("0", "0x00000000") // 3. Bring back the columns that reveal the changing utility | project TimeGenerated, DeviceName, RegistryKey, RegistryValueData, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, InitiatingProcessSHA256, InitiatingProcessVersionInfoCompanyName, InitiatingProcessAccountDomain, InitiatingProcessAccountName // 4. Summarise so we can quickly see which tool did it (and how often) | summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), EventCount=count(), AffectedDevices=dcount(DeviceName) by InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, InitiatingProcessSHA256, InitiatingProcessVersionInfoCompanyName | order by EventCount desc, LastSeen desc

DeviceRegistryEvents | where RegistryKey has "Policies\\System" and RegistryValueName == "EnableLUA" and RegistryValueData == "0" | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName | sort by TimeGenerated desc

DeviceRegistryEvents | where RegistryValueName == "EnableLUA" | where RegistryValueData == "0" | where RegistryKey has "Policies" and RegistryKey has "System" | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId | sort by TimeGenerated desc

DeviceRegistryEvents | where tolower(RegistryKey) startswith "hkey_local_machine\\software\\microsoft\\windows\\currentversion\\policies\\system" and RegistryValueName == "EnableLUA" and RegistryValueData == "0" | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine | sort by TimeGenerated asc