Review Windows registry event logs for the ProcessCreationIncludeCmdLine_Enabled value being set to 0. Which PowerShell cmdlet performed this change?

DeviceRegistryEvents
| where ActionType == "RegistryValueSet"
| where RegistryValueName == "ProcessCreationIncludeCmdLine_Enabled"
| where RegistryValueData == "0"
| where InitiatingProcessFileName contains "powershell"
| project Timestamp, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine

DeviceRegistryEvents | where RegistryValueData == '0' | project InitiatingProcessCommandLine

DeviceRegistryEvents
| where RegistryValueName == 'ProcessCreationIncludeCmdLine_Enabled' and RegistryValueData == '0'
| project InitiatingProcessCommandLine

DeviceRegistryEvents
| where RegistryValueName == "ProcessCreationIncludeCmdLine_Enabled"
| where RegistryValueData == "0"
| where InitiatingProcessFileName has_cs "powershell"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, RegistryKey, RegistryValueName, RegistryValueData

DeviceRegistryEvents
| where RegistryValueName == "ProcessCreationIncludeCmdLine_Enabled" and RegistryValueData == "0"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| order by TimeGenerated desc

// Set the time of the latest registry change with the target value
let registry_change_time = toscalar(DeviceRegistryEvents
    | where RegistryValueName == 'ProcessCreationIncludeCmdLine_Enabled' and RegistryValueData == '0'
    | summarize max(TimeGenerated));

// Find devices where this change occurred at the latest change time
DeviceRegistryEvents
| where RegistryValueName == 'ProcessCreationIncludeCmdLine_Enabled' and RegistryValueData == '0'
| where TimeGenerated == registry_change_time
| project DeviceId, TimeGenerated
| join kind=inner (
    // Find PowerShell processes on the same device that started before the change
    DeviceProcessEvents
    | where FileName in ('powershell.exe', 'pwsh.exe')
    | extend ProcessStartTime = ProcessCreationTime
) on DeviceId
| where ProcessStartTime < TimeGenerated
// Find the latest process start time per device
| summarize arg_max(ProcessStartTime, ProcessCommandLine) by DeviceId
| project DeviceId, ProcessCommandLine, ProcessStartTime

DeviceRegistryEvents
| where RegistryValueName == "ProcessCreationIncludeCmdLine_Enabled" and RegistryValueData == "0"
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, InitiatingProcessFileName, InitiatingProcessCommandLine

DeviceRegistryEvents
| where ActionType in ("RegistryValueSet","RegistryValueCreate","RegistryValueModified")
| where RegistryValueName =~ "ProcessCreationIncludeCmdLine_Enabled"
// Registry path for the policy (keep flexible but prefer the expected location)
| where RegistryKey has @"\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit"
// Normalize value data variants like 0, 0x00000000, dword:00000000
| where tostring(RegistryValueData) matches regex @"^(?i)(?:0|0x0+|dword:0+)$"
// Limit to PowerShell engines
| where tolower(InitiatingProcessFileName) in ("powershell.exe", "pwsh.exe", "powershell_ise.exe")
// Extract likely cmdlet used in the command line
| extend Cmdlet = extract(@"(?i)\b(Set-ItemProperty|New-ItemProperty|Set-Item|New-Item|Remove-ItemProperty|Clear-ItemProperty)\b", 1, InitiatingProcessCommandLine)
| extend Cmdlet = iif(isempty(Cmdlet), "Unknown", Cmdlet)
| summarize EventCount=count(), Devices=dcount(DeviceId), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), SampleCommands=make_set(InitiatingProcessCommandLine, 3)
          by Cmdlet
| order by EventCount desc

DeviceRegistryEvents
| where RegistryValueName has_cs "ProcessCreationIncludeCmdLine_Enabled"
| where tostring(RegistryValueData) == "0" or toint(RegistryValueData) == 0
| extend InitiatingUser = coalesce(InitiatingProcessAccountName, InitiatingProcessAccountUpn, InitiatingProcessAccountSid)
| where isnotempty(InitiatingProcessCommandLine)
// focus on PowerShell / pwsh or common registry modification commands
| where InitiatingProcessCommandLine has_cs "powershell" or InitiatingProcessCommandLine has_cs "pwsh" or InitiatingProcessCommandLine has_cs "Set-ItemProperty" or InitiatingProcessCommandLine has_cs "Set-Item" or InitiatingProcessCommandLine has_cs "New-ItemProperty" or InitiatingProcessCommandLine has_cs "Remove-ItemProperty" or InitiatingProcessCommandLine has_cs "Add-ItemProperty" or InitiatingProcessCommandLine has_cs "reg.exe" or InitiatingProcessCommandLine has_cs "reg add"
| extend Cmdlet = extract(@"(?i)\b(Set-ItemProperty|New-ItemProperty|Remove-ItemProperty|Add-ItemProperty|Set-ItemPropertyValue|Set-Item|Get-ItemProperty|Get-Item|reg(?:\.exe)?\s+add|reg\s+add)\b", 1, InitiatingProcessCommandLine)
| project TimeGenerated, DeviceName, DeviceId, InitiatingUser, InitiatingProcessFileName, InitiatingProcessId, InitiatingProcessCommandLine, Cmdlet, RegistryKey, RegistryValueName, RegistryValueData, PreviousRegistryKey, PreviousRegistryValueData
| order by TimeGenerated desc
| take 50

DeviceRegistryEvents
| where RegistryValueName =~ "ProcessCreationIncludeCmdLine_Enabled"
| where RegistryValueData == "0" or RegistryValueData == 0
| where TimeGenerated between (startofday(ago(30d))..now())
| extend InitiatorExe = tolower(InitiatingProcessFileName), InitiatorCmd = tostring(InitiatingProcessCommandLine)
| where InitiatorExe contains "powershell" or InitiatorCmd contains "Set-ItemProperty" or InitiatorCmd contains "Set-Item" or InitiatorCmd contains "New-ItemProperty" or InitiatorCmd contains "reg.exe" or InitiatorCmd contains "reg add"
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessId, InitiatingProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessSessionId, InitiatingProcessCreationTime, ReportId
| order by TimeGenerated desc

let targetValueName = "ProcessCreationIncludeCmdLine_Enabled";
let targetValueData = "0";
DeviceRegistryEvents
| where tostring(RegistryValueName) == targetValueName
| where tostring(RegistryValueData) == targetValueData
| extend InitiatingProcessCommandLine = coalesce(tostring(InitiatingProcessCommandLine), "")
| extend InitiatingProcessFileNameLower = tolower(tostring(InitiatingProcessFileName)), InitiatingProcessCommandLineLower = tolower(InitiatingProcessCommandLine)
| extend IsPowerShell = InitiatingProcessFileNameLower contains "powershell" or InitiatingProcessFileNameLower contains "pwsh" or InitiatingProcessCommandLineLower contains "powershell" or InitiatingProcessCommandLineLower contains "pwsh"
| extend IsRegExe = InitiatingProcessFileNameLower contains "reg.exe" or InitiatingProcessCommandLineLower contains "reg add" or InitiatingProcessCommandLineLower startswith "reg "
| extend CmdletFromPowerShell = extract(@"(?i)\b([A-Za-z]+-[A-Za-z]+)\b", 1, InitiatingProcessCommandLine)
| extend ExtractedCmdlet = iif(IsPowerShell, CmdletFromPowerShell, iif(IsRegExe, "reg.exe", ""))
| project TimeGenerated, DeviceName, DeviceId, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine, IsPowerShell, IsRegExe, ExtractedCmdlet, RegistryKey, RegistryValueName, RegistryValueData, PreviousRegistryValueData, ActionType
| sort by TimeGenerated desc

DeviceRegistryEvents
| where RegistryValueName == "ProcessCreationIncludeCmdLine_Enabled"
| where toint(RegistryValueData) == 0
| where isnotempty(InitiatingProcessCommandLine)
| extend PSLine = tostring(InitiatingProcessCommandLine)
| extend Cmdlet = extract(@"(?i)\b(Set-ItemProperty|Set-ItemPropertyValue|New-ItemProperty|Set-RegistryValue)\b", 1, PSLine)
| project TimeGenerated, DeviceName, DeviceId, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine, Cmdlet
| sort by TimeGenerated desc

DeviceRegistryEvents
| where RegistryValueName == 'ProcessCreationIncludeCmdLine_Enabled'
| where RegistryValueData == '0'
| where InitiatingProcessFileName has 'powershell.exe'
| project Timestamp, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessCommandLine
| order by Timestamp desc
| limit 100

DeviceRegistryEvents
| where RegistryValueName == "ProcessCreationIncludeCmdLine_Enabled"
| where RegistryValueData == "0"
| where InitiatingProcessFileName =~ "powershell.exe"
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessCommandLine, InitiatingProcessFileName
| order by TimeGenerated desc

DeviceRegistryEvents
| where RegistryValueName =~ "ProcessCreationIncludeCmdLine_Enabled"
| where RegistryValueData == "0"
| where InitiatingProcessFileName =~ "powershell.exe"
| project TimeGenerated, DeviceName, ActionType, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessCommandLine, InitiatingProcessAccountName
| order by TimeGenerated desc

DeviceRegistryEvents
| where RegistryValueName == "ProcessCreationIncludeCmdLine_Enabled"
| where tostring(RegistryValueData) == "0" or RegistryValueData == 0
// Limit to modifications (for some tenants ActionType could be RegistryValueSet, CreateKey, etc.)
| where ActionType =~ "RegistryValueSet" or ActionType =~ "RegistryValueChange" or ActionType =~ "SetValue"
// Make sure the change was done from a PowerShell host
| where InitiatingProcessFileName =~ "powershell.exe" or InitiatingProcessCommandLine has "powershell"
// Extract the first PowerShell cmdlet that appears in the command line
| extend Cmdlet = extract(@"\b([A-Za-z]+-[A-Za-z]+)\b", 1, InitiatingProcessCommandLine)
| extend Cmdlet = iff(isempty(Cmdlet), "Unknown", Cmdlet)
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, Cmdlet
| summarize
    FirstSeen=min(TimeGenerated),
    LastSeen=max(TimeGenerated),
    Events=count()
  by Cmdlet, DeviceName, InitiatingProcessAccountName
| order by Events desc, LastSeen desc

DeviceRegistryEvents
| where RegistryValueName == "ProcessCreationIncludeCmdLine_Enabled" and RegistryValueData == "0"
| where tolower(InitiatingProcessFileName) contains "powershell.exe"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RegistryKey, RegistryValueData
| order by TimeGenerated desc

DeviceRegistryEvents
| where RegistryValueName == "ProcessCreationIncludeCmdLine_Enabled" and RegistryValueData == "0"
| where tolower(InitiatingProcessFileName) contains "powershell"
// Attempt to extract common PowerShell cmdlets that might change registry settings
| extend CmdletName = extract("(Set-ItemProperty|New-ItemProperty|Remove-ItemProperty)", 1, InitiatingProcessCommandLine)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, CmdletName, InitiatingProcessCommandLine
| order by TimeGenerated desc

DeviceRegistryEvents
| where RegistryValueName == "ProcessCreationIncludeCmdLine_Enabled"
| where RegistryValueData == "0"
// include any PowerShell host in the command line
| where tolower(InitiatingProcessCommandLine) contains "powershell"
// extract the cmdlet name from the command line
| extend Cmdlet = extract(@"(?i)\b(Set-ItemProperty|New-ItemProperty|Remove-ItemProperty|Set-Item|Clear-ItemProperty)\b", 1, InitiatingProcessCommandLine)
| where isnotempty(Cmdlet)
| project TimeGenerated,
          DeviceName,
          InitiatingProcessAccountName,
          Cmdlet,
          InitiatingProcessCommandLine,
          RegistryKey,
          RegistryValueData