Question Analysis

DeviceRegistryEvents | where ActionType == "RegistryValueSet" | where InitiatingProcessFileName =~ "powershell.exe" | distinct RegistryValueName

DeviceRegistryEvents | where InitiatingProcessFileName contains "powershell" and (ActionType contains "Create" or ActionType contains "Add") | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessCommandLine, InitiatingProcessFileName

DeviceRegistryEvents | where ( tolower(InitiatingProcessFileName) contains "powershell" or tolower(InitiatingProcessCommandLine) contains "powershell" or tolower(InitiatingProcessFileName) contains "pwsh" or tolower(InitiatingProcessCommandLine) contains "pwsh" or tolower(InitiatingProcessCommandLine) contains "-encodedcommand" or tolower(InitiatingProcessCommandLine) contains "-enc" ) | where ( ActionType contains "Create" or ActionType contains "Set" or ActionType contains "Write" or ActionType contains "Changed" ) | where ( tolower(RegistryKey) contains "\\software\\policies" or tolower(RegistryKey) contains "\\system\\currentcontrolset\\services" or tolower(RegistryKey) contains "windows\\currentversion\\policies" or tolower(RegistryKey) contains "\\currentversion\\run" or tolower(RegistryKey) contains "\\controlset001\\services" or tolower(RegistryKey) contains "\\explorer" or tolower(RegistryKey) contains "\\policies" ) | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RegistryKey, RegistryValueName = coalesce(RegistryValueName, "<empty>"), RegistryValueData, RegistryValueType, ActionType | summarize Count = count(), AnyCommandLine = any(InitiatingProcessCommandLine), AnyProcess = any(InitiatingProcessFileName), AnyValueData = any(RegistryValueData) by RegistryValueName, RegistryKey, DeviceName | where Count > 0 | order by Count desc, RegistryValueName asc

DeviceRegistryEvents | where TimeGenerated between (startofday(ago(7d)) .. endofday(now())) | where InitiatingProcessFileName has_cs 'powershell' | where ActionType in ('RegistryValueSet', 'RegistryValueWritten') | summarize by RegistryValueName, DeviceName, RegistryKey, InitiatingProcessFileName | project RegistryValueName, DeviceName, RegistryKey, InitiatingProcessFileName

DeviceRegistryEvents | where ActionType contains "create" // focuses on new registry value creations | where InitiatingProcessCommandLine has "powershell" // identifies PowerShell-driven changes | where RegistryKey has_any ("Policy", "FileSystem") // filters only relevant policy/file system keys | summarize CreatedRegistryValueNames = make_set(RegistryValueName)

DeviceRegistryEvents | where InitiatingProcessFileName endswith "powershell.exe" | where RegistryKey has_any ("Policies", "FileSystem") | where ActionType in ("RegistryValueSet", "RegistryValueCreated", "SetValue") | distinct RegistryValueName

// ---- BlackByte preparation – PowerShell-driven writes to system policy & file-system registry keys let targetPaths = dynamic(["\\SOFTWARE\\Policies\\", "\\SYSTEM\\CurrentControlSet\\Control\\FileSystem"]); DeviceRegistryEvents // (Time range filter supplied by the hunting portal) | where ActionType in ("RegistryValueSet", "RegValueSet", "RegistryKeyCreated", "RegistryKeySet") | where RegistryKey has_any (targetPaths) | where InitiatingProcessFileName =~ "powershell.exe" or InitiatingProcessCommandLine has_cs "powershell" | where isnotempty(RegistryValueName) | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine | summarize CreatedRegistryValueNames = make_set(RegistryValueName)

DeviceRegistryEvents | where ActionType in ("RegistryValueCreated", "RegistryValueSet") | where (InitiatingProcessCommandLine has_cs "powershell" or InitiatingProcessFileName has_cs "powershell.exe" or InitiatingProcessCommandLine has_cs "pwsh" or InitiatingProcessFileName has_cs "pwsh.exe") | where tolower(RegistryKey) has "policies" or tolower(RegistryKey) has "filesystem" | distinct RegistryValueName

DeviceRegistryEvents | where InitiatingProcessFileName has "powershell.exe" | where RegistryKey has_any ("Policies", "FileSystem") | distinct RegistryValueName

DeviceRegistryEvents | where ActionType in ("RegistryValueSet", "RegistryValueAdded") | where tolower(InitiatingProcessFileName) has "powershell" | where RegistryKey has "\\SYSTEM\\CurrentControlSet\\Control\\FileSystem" or RegistryKey has "\\SOFTWARE\\Policies" | where isnotempty(RegistryValueName) | summarize CreatedValueNames = make_set(RegistryValueName) by RegistryKey | project RegistryKey, CreatedValueNames

DeviceRegistryEvents | where InitiatingProcessFileName =~ "powershell.exe" | where ActionType == "RegistryValueSet" | where RegistryKey startswith "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies" or RegistryKey startswith "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Policies" or RegistryKey startswith "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\FileSystem" | distinct RegistryValueName | sort by RegistryValueName asc