Question Analysis

DeviceRegistryEvents | where RegistryKey has "Terminal Server" | where ActionType == "RegistryValueSet" | where RegistryValueData == "0" | project RegistryValueName

DeviceRegistryEvents | where ActionType == 'RegistryValueSet' | where RegistryKey contains 'Terminal Server' | project TimeGenerated, DeviceName, InitiatingProcessFileName, RegistryKey, RegistryValueName, RegistryValueData

DeviceRegistryEvents | where ActionType == "RegistryValueSet" // Terminal Server config path (handles CurrentControlSet/ControlSet00x) and policy path | where tolower(RegistryKey) has @"\control\terminal server" or tolower(RegistryKey) has @"\software\policies\microsoft\windows nt\terminal services" | extend NewValue = tostring(RegistryValueData), OldValue = tostring(PreviousRegistryValueData) | extend NewValueNorm = trim(' ', tolower(NewValue)) // Either the specific value name or any write that clearly set it to disabled (1) | where tolower(RegistryValueName) == "fdenytsconnections" or NewValueNorm in ("1","0x1","0x00000001","dword:00000001") | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, OldValue, NewValue, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine | order by TimeGenerated desc

DeviceRegistryEvents | where TimeGenerated between (startofday(ago(30d)) .. now()) | where tolower(RegistryKey) has_any ("terminal server", "currentcontrolset\\control\\terminal server", "winstations", "rdp-tcp", "termsrv") | where ActionType has_any ("set", "setvalue", "write", "modify", "registryvalueset", "registryvaluechanged") | extend ChangedValueName = tolower(coalesce(RegistryValueName, PreviousRegistryValueName)) | extend NewValue = tostring(RegistryValueData), OldValue = tostring(PreviousRegistryValueData) | where isnotempty(ChangedValueName) | where ChangedValueName in ("fdenytsconnections", "userauthentication", "fallowtogethelp") or ChangedValueName contains "deny" or ChangedValueName contains "allow" or ChangedValueName contains "auth" | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, ActionType, RegistryKey, ChangedValueName, OldValue, NewValue | order by TimeGenerated desc | take 100

let TerminalServerKey = "SYSTEM\\CurrentControlSet\\Control\\Terminal Server"; DeviceRegistryEvents | where TimeGenerated >= ago(7d) | where RegistryKey has (TerminalServerKey) or RegistryKey has "CurrentControlSet\\Control\\Terminal Server" or RegistryKey has "Terminal Server" | where RegistryValueName in ("fDenyTSConnections", "fDisableRDP") | where ActionType in ("RegistryValueSet", "RegistryValueModified", "RegistryValueWrite", "RegistryValueCreated") | project TimeGenerated, DeviceName, DeviceId, RegistryKey, RegistryValueName, RegistryValueData, PreviousRegistryKey, PreviousRegistryValueName, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine | sort by TimeGenerated desc

DeviceRegistryEvents | where Timestamp > ago(30d) | where ActionType == 'RegistryValueSet' | where RegistryKey contains 'Terminal Server' | project Timestamp, DeviceName, RegistryKey, RegistryValueName, RegistryValueData | order by Timestamp desc

DeviceRegistryEvents | where RegistryKey has "\\Control\\Terminal Server" | where ActionType in ("RegistryValueSet", "RegistryValueModified", "RegistryValueUpdate") | where RegistryValueName == "fDenyTSConnections" | project TimeGenerated, DeviceName, ActionType, PreviousRegistryValueData, RegistryValueData, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessCommandLine, RegistryKey | order by TimeGenerated desc

// --- RDP disabled via registry investigation DeviceRegistryEvents | where RegistryKey has "\\Control\\Terminal Server" // Terminal Server branch | where ActionType in ("SetValue", // MDE normalised action types "RegistryValueSet", "RegistryValueModified", "CreateValue") // timerange placeholder will be injected by the calling function // | where TimeGenerated between (datetime_start .. datetime_end) | project TimeGenerated, DeviceName, ActionType, RegistryKey, RegistryValueName, PreviousRegistryValueData, RegistryValueData, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine | extend DisabledRDP = iff(RegistryValueName == "fDenyTSConnections" and RegistryValueData == "1", "Yes", "No") | summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), EventCount=count() by DeviceName, RegistryValueName, DisabledRDP, RegistryKey | order by LastSeen desc

DeviceRegistryEvents | where RegistryKey has "Terminal Server" | where ActionType =~ "RegistryValueSet" | summarize EventCount=count() by RegistryValueName | order by EventCount desc

DeviceRegistryEvents | where RegistryKey has "Control\\Terminal Server" | where ActionType has "RegistryValueSet" // Adjust this filter if needed to capture modification events | summarize count() by RegistryValueName | order by count_ desc | project RegistryValueName, Count = count_