Review registry event logs on the Windows host for PowerShell-driven writes to system policy and file system keys. Which registry value names were created during this BlackByte preparation simulation?

DeviceRegistryEvents
| where ActionType == "RegistryValueSet"
| where InitiatingProcessFileName =~ "powershell.exe"
| distinct RegistryValueName

DeviceRegistryEvents
| where InitiatingProcessFileName contains "powershell" and (ActionType contains "Create" or ActionType contains "Add")
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessCommandLine, InitiatingProcessFileName

DeviceRegistryEvents
| where (
    tolower(InitiatingProcessFileName) contains "powershell"
    or tolower(InitiatingProcessCommandLine) contains "powershell"
    or tolower(InitiatingProcessFileName) contains "pwsh"
    or tolower(InitiatingProcessCommandLine) contains "pwsh"
    or tolower(InitiatingProcessCommandLine) contains "-encodedcommand"
    or tolower(InitiatingProcessCommandLine) contains "-enc"
)
| where (
    ActionType contains "Create"
    or ActionType contains "Set"
    or ActionType contains "Write"
    or ActionType contains "Changed"
)
| where (
    tolower(RegistryKey) contains "\\software\\policies"
    or tolower(RegistryKey) contains "\\system\\currentcontrolset\\services"
    or tolower(RegistryKey) contains "windows\\currentversion\\policies"
    or tolower(RegistryKey) contains "\\currentversion\\run"
    or tolower(RegistryKey) contains "\\controlset001\\services"
    or tolower(RegistryKey) contains "\\explorer"
    or tolower(RegistryKey) contains "\\policies"
)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RegistryKey, RegistryValueName = coalesce(RegistryValueName, "<empty>"), RegistryValueData, RegistryValueType, ActionType
| summarize Count = count(), AnyCommandLine = any(InitiatingProcessCommandLine), AnyProcess = any(InitiatingProcessFileName), AnyValueData = any(RegistryValueData) by RegistryValueName, RegistryKey, DeviceName
| where Count > 0
| order by Count desc, RegistryValueName asc

DeviceRegistryEvents
| where TimeGenerated between (startofday(ago(7d)) .. endofday(now()))
| where InitiatingProcessFileName has_cs 'powershell'
| where ActionType in ('RegistryValueSet', 'RegistryValueWritten')
| summarize by RegistryValueName, DeviceName, RegistryKey, InitiatingProcessFileName
| project RegistryValueName, DeviceName, RegistryKey, InitiatingProcessFileName

DeviceRegistryEvents
| where ActionType contains "create" // focuses on new registry value creations
| where InitiatingProcessCommandLine has "powershell" // identifies PowerShell-driven changes
| where RegistryKey has_any ("Policy", "FileSystem") // filters only relevant policy/file system keys
| summarize CreatedRegistryValueNames = make_set(RegistryValueName)

DeviceRegistryEvents
| where InitiatingProcessFileName endswith "powershell.exe"
| where RegistryKey has_any ("Policies", "FileSystem")
| where ActionType in ("RegistryValueSet", "RegistryValueCreated", "SetValue")
| distinct RegistryValueName

// ---- BlackByte preparation – PowerShell-driven writes to system policy & file-system registry keys
let targetPaths = dynamic(["\\SOFTWARE\\Policies\\", "\\SYSTEM\\CurrentControlSet\\Control\\FileSystem"]);
DeviceRegistryEvents
// (Time range filter supplied by the hunting portal)
| where ActionType in ("RegistryValueSet", "RegValueSet", "RegistryKeyCreated", "RegistryKeySet")
| where RegistryKey has_any (targetPaths)
| where InitiatingProcessFileName =~ "powershell.exe" or InitiatingProcessCommandLine has_cs "powershell"
| where isnotempty(RegistryValueName)
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData,
          InitiatingProcessFileName, InitiatingProcessCommandLine
| summarize CreatedRegistryValueNames = make_set(RegistryValueName)

DeviceRegistryEvents
| where ActionType in ("RegistryValueCreated", "RegistryValueSet")
| where (InitiatingProcessCommandLine has_cs "powershell" or InitiatingProcessFileName has_cs "powershell.exe" or InitiatingProcessCommandLine has_cs "pwsh" or InitiatingProcessFileName has_cs "pwsh.exe")
| where tolower(RegistryKey) has "policies" or tolower(RegistryKey) has "filesystem"
| distinct RegistryValueName

DeviceRegistryEvents
| where InitiatingProcessFileName has "powershell.exe"
| where RegistryKey has_any ("Policies", "FileSystem")
| distinct RegistryValueName

DeviceRegistryEvents
| where ActionType in ("RegistryValueSet", "RegistryValueAdded")
| where tolower(InitiatingProcessFileName) has "powershell"
| where RegistryKey has "\\SYSTEM\\CurrentControlSet\\Control\\FileSystem" or RegistryKey has "\\SOFTWARE\\Policies"
| where isnotempty(RegistryValueName)
| summarize CreatedValueNames = make_set(RegistryValueName) by RegistryKey
| project RegistryKey, CreatedValueNames

DeviceRegistryEvents
| where InitiatingProcessFileName =~ "powershell.exe"
| where ActionType == "RegistryValueSet"
| where RegistryKey startswith "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies"
    or RegistryKey startswith "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Policies"
    or RegistryKey startswith "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\FileSystem"
| distinct RegistryValueName
| sort by RegistryValueName asc