Question Analysis

DeviceRegistryEvents | where ActionType == "RegistryValueSet" | where RegistryValueName == "ProcessCreationIncludeCmdLine_Enabled" | where RegistryValueData == "0" | where InitiatingProcessFileName contains "powershell" | project Timestamp, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine

DeviceRegistryEvents | where RegistryValueData == '0' | project InitiatingProcessCommandLine

DeviceRegistryEvents | where RegistryValueName == 'ProcessCreationIncludeCmdLine_Enabled' and RegistryValueData == '0' | project InitiatingProcessCommandLine

DeviceRegistryEvents | where RegistryValueName == "ProcessCreationIncludeCmdLine_Enabled" | where RegistryValueData == "0" | where InitiatingProcessFileName has_cs "powershell" | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, RegistryKey, RegistryValueName, RegistryValueData

DeviceRegistryEvents | where RegistryValueName == "ProcessCreationIncludeCmdLine_Enabled" and RegistryValueData == "0" | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName | order by TimeGenerated desc

// Set the time of the latest registry change with the target value let registry_change_time = toscalar(DeviceRegistryEvents | where RegistryValueName == 'ProcessCreationIncludeCmdLine_Enabled' and RegistryValueData == '0' | summarize max(TimeGenerated)); // Find devices where this change occurred at the latest change time DeviceRegistryEvents | where RegistryValueName == 'ProcessCreationIncludeCmdLine_Enabled' and RegistryValueData == '0' | where TimeGenerated == registry_change_time | project DeviceId, TimeGenerated | join kind=inner ( // Find PowerShell processes on the same device that started before the change DeviceProcessEvents | where FileName in ('powershell.exe', 'pwsh.exe') | extend ProcessStartTime = ProcessCreationTime ) on DeviceId | where ProcessStartTime < TimeGenerated // Find the latest process start time per device | summarize arg_max(ProcessStartTime, ProcessCommandLine) by DeviceId | project DeviceId, ProcessCommandLine, ProcessStartTime

DeviceRegistryEvents | where RegistryValueName == "ProcessCreationIncludeCmdLine_Enabled" and RegistryValueData == "0" | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, InitiatingProcessFileName, InitiatingProcessCommandLine

DeviceRegistryEvents | where ActionType in ("RegistryValueSet","RegistryValueCreate","RegistryValueModified") | where RegistryValueName =~ "ProcessCreationIncludeCmdLine_Enabled" // Registry path for the policy (keep flexible but prefer the expected location) | where RegistryKey has @"\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit" // Normalize value data variants like 0, 0x00000000, dword:00000000 | where tostring(RegistryValueData) matches regex @"^(?i)(?:0|0x0+|dword:0+)$" // Limit to PowerShell engines | where tolower(InitiatingProcessFileName) in ("powershell.exe", "pwsh.exe", "powershell_ise.exe") // Extract likely cmdlet used in the command line | extend Cmdlet = extract(@"(?i)\b(Set-ItemProperty|New-ItemProperty|Set-Item|New-Item|Remove-ItemProperty|Clear-ItemProperty)\b", 1, InitiatingProcessCommandLine) | extend Cmdlet = iif(isempty(Cmdlet), "Unknown", Cmdlet) | summarize EventCount=count(), Devices=dcount(DeviceId), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), SampleCommands=make_set(InitiatingProcessCommandLine, 3) by Cmdlet | order by EventCount desc

DeviceRegistryEvents | where RegistryValueName has_cs "ProcessCreationIncludeCmdLine_Enabled" | where tostring(RegistryValueData) == "0" or toint(RegistryValueData) == 0 | extend InitiatingUser = coalesce(InitiatingProcessAccountName, InitiatingProcessAccountUpn, InitiatingProcessAccountSid) | where isnotempty(InitiatingProcessCommandLine) // focus on PowerShell / pwsh or common registry modification commands | where InitiatingProcessCommandLine has_cs "powershell" or InitiatingProcessCommandLine has_cs "pwsh" or InitiatingProcessCommandLine has_cs "Set-ItemProperty" or InitiatingProcessCommandLine has_cs "Set-Item" or InitiatingProcessCommandLine has_cs "New-ItemProperty" or InitiatingProcessCommandLine has_cs "Remove-ItemProperty" or InitiatingProcessCommandLine has_cs "Add-ItemProperty" or InitiatingProcessCommandLine has_cs "reg.exe" or InitiatingProcessCommandLine has_cs "reg add" | extend Cmdlet = extract(@"(?i)\b(Set-ItemProperty|New-ItemProperty|Remove-ItemProperty|Add-ItemProperty|Set-ItemPropertyValue|Set-Item|Get-ItemProperty|Get-Item|reg(?:\.exe)?\s+add|reg\s+add)\b", 1, InitiatingProcessCommandLine) | project TimeGenerated, DeviceName, DeviceId, InitiatingUser, InitiatingProcessFileName, InitiatingProcessId, InitiatingProcessCommandLine, Cmdlet, RegistryKey, RegistryValueName, RegistryValueData, PreviousRegistryKey, PreviousRegistryValueData | order by TimeGenerated desc | take 50

DeviceRegistryEvents | where RegistryValueName =~ "ProcessCreationIncludeCmdLine_Enabled" | where RegistryValueData == "0" or RegistryValueData == 0 | where TimeGenerated between (startofday(ago(30d))..now()) | extend InitiatorExe = tolower(InitiatingProcessFileName), InitiatorCmd = tostring(InitiatingProcessCommandLine) | where InitiatorExe contains "powershell" or InitiatorCmd contains "Set-ItemProperty" or InitiatorCmd contains "Set-Item" or InitiatorCmd contains "New-ItemProperty" or InitiatorCmd contains "reg.exe" or InitiatorCmd contains "reg add" | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessId, InitiatingProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessSessionId, InitiatingProcessCreationTime, ReportId | order by TimeGenerated desc

let targetValueName = "ProcessCreationIncludeCmdLine_Enabled"; let targetValueData = "0"; DeviceRegistryEvents | where tostring(RegistryValueName) == targetValueName | where tostring(RegistryValueData) == targetValueData | extend InitiatingProcessCommandLine = coalesce(tostring(InitiatingProcessCommandLine), "") | extend InitiatingProcessFileNameLower = tolower(tostring(InitiatingProcessFileName)), InitiatingProcessCommandLineLower = tolower(InitiatingProcessCommandLine) | extend IsPowerShell = InitiatingProcessFileNameLower contains "powershell" or InitiatingProcessFileNameLower contains "pwsh" or InitiatingProcessCommandLineLower contains "powershell" or InitiatingProcessCommandLineLower contains "pwsh" | extend IsRegExe = InitiatingProcessFileNameLower contains "reg.exe" or InitiatingProcessCommandLineLower contains "reg add" or InitiatingProcessCommandLineLower startswith "reg " | extend CmdletFromPowerShell = extract(@"(?i)\b([A-Za-z]+-[A-Za-z]+)\b", 1, InitiatingProcessCommandLine) | extend ExtractedCmdlet = iif(IsPowerShell, CmdletFromPowerShell, iif(IsRegExe, "reg.exe", "")) | project TimeGenerated, DeviceName, DeviceId, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine, IsPowerShell, IsRegExe, ExtractedCmdlet, RegistryKey, RegistryValueName, RegistryValueData, PreviousRegistryValueData, ActionType | sort by TimeGenerated desc

DeviceRegistryEvents | where RegistryValueName == "ProcessCreationIncludeCmdLine_Enabled" | where toint(RegistryValueData) == 0 | where isnotempty(InitiatingProcessCommandLine) | extend PSLine = tostring(InitiatingProcessCommandLine) | extend Cmdlet = extract(@"(?i)\b(Set-ItemProperty|Set-ItemPropertyValue|New-ItemProperty|Set-RegistryValue)\b", 1, PSLine) | project TimeGenerated, DeviceName, DeviceId, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine, Cmdlet | sort by TimeGenerated desc

DeviceRegistryEvents | where RegistryValueName == 'ProcessCreationIncludeCmdLine_Enabled' | where RegistryValueData == '0' | where InitiatingProcessFileName has 'powershell.exe' | project Timestamp, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessCommandLine | order by Timestamp desc | limit 100

DeviceRegistryEvents | where RegistryValueName == "ProcessCreationIncludeCmdLine_Enabled" | where RegistryValueData == "0" | where InitiatingProcessFileName =~ "powershell.exe" | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessCommandLine, InitiatingProcessFileName | order by TimeGenerated desc

DeviceRegistryEvents | where RegistryValueName =~ "ProcessCreationIncludeCmdLine_Enabled" | where RegistryValueData == "0" | where InitiatingProcessFileName =~ "powershell.exe" | project TimeGenerated, DeviceName, ActionType, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessCommandLine, InitiatingProcessAccountName | order by TimeGenerated desc

DeviceRegistryEvents | where RegistryValueName == "ProcessCreationIncludeCmdLine_Enabled" | where tostring(RegistryValueData) == "0" or RegistryValueData == 0 // Limit to modifications (for some tenants ActionType could be RegistryValueSet, CreateKey, etc.) | where ActionType =~ "RegistryValueSet" or ActionType =~ "RegistryValueChange" or ActionType =~ "SetValue" // Make sure the change was done from a PowerShell host | where InitiatingProcessFileName =~ "powershell.exe" or InitiatingProcessCommandLine has "powershell" // Extract the first PowerShell cmdlet that appears in the command line | extend Cmdlet = extract(@"\b([A-Za-z]+-[A-Za-z]+)\b", 1, InitiatingProcessCommandLine) | extend Cmdlet = iff(isempty(Cmdlet), "Unknown", Cmdlet) | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, Cmdlet | summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Events=count() by Cmdlet, DeviceName, InitiatingProcessAccountName | order by Events desc, LastSeen desc

DeviceRegistryEvents | where RegistryValueName == "ProcessCreationIncludeCmdLine_Enabled" and RegistryValueData == "0" | where tolower(InitiatingProcessFileName) contains "powershell.exe" | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RegistryKey, RegistryValueData | order by TimeGenerated desc

DeviceRegistryEvents | where RegistryValueName == "ProcessCreationIncludeCmdLine_Enabled" and RegistryValueData == "0" | where tolower(InitiatingProcessFileName) contains "powershell" // Attempt to extract common PowerShell cmdlets that might change registry settings | extend CmdletName = extract("(Set-ItemProperty|New-ItemProperty|Remove-ItemProperty)", 1, InitiatingProcessCommandLine) | project TimeGenerated, DeviceName, InitiatingProcessFileName, CmdletName, InitiatingProcessCommandLine | order by TimeGenerated desc

DeviceRegistryEvents | where RegistryValueName == "ProcessCreationIncludeCmdLine_Enabled" | where RegistryValueData == "0" // include any PowerShell host in the command line | where tolower(InitiatingProcessCommandLine) contains "powershell" // extract the cmdlet name from the command line | extend Cmdlet = extract(@"(?i)\b(Set-ItemProperty|New-ItemProperty|Remove-ItemProperty|Set-Item|Clear-ItemProperty)\b", 1, InitiatingProcessCommandLine) | where isnotempty(Cmdlet) | project TimeGenerated, DeviceName, InitiatingProcessAccountName, Cmdlet, InitiatingProcessCommandLine, RegistryKey, RegistryValueData