Question Analysis

DeviceRegistryEvents | where ActionType == "RegistryValueSet" | where RegistryKey has @"\SOFTWARE\Microsoft\Active Setup\Installed Components" | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName

let ActiveSetupEvents = DeviceRegistryEvents | where ActionType in ("RegistryKeyCreated","RegistryValueCreated","RegistryValueSet") | where RegistryKey has "\\Microsoft\\Active Setup\\Installed Components\\" | extend ComponentId = tostring(extract(@"(?i)\\active setup\\installed components\\([^\\]+)", 1, RegistryKey)) | where isnotempty(ComponentId); let KeyCreated = ActiveSetupEvents | where ActionType == "RegistryKeyCreated" | summarize KeyCreateTime=min(TimeGenerated), CreatedByProcess=any(InitiatingProcessFileName), CreatedByCommandLine=any(InitiatingProcessCommandLine) by DeviceId, DeviceName, ComponentId; let ValuePivot = ActiveSetupEvents | summarize StubPath=anyif(RegistryValueData, tolower(RegistryValueName) == "stubpath"), DisplayName=anyif(RegistryValueData, tolower(RegistryValueName) == "displayname"), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by DeviceId, DeviceName, ComponentId; let RunOnce = DeviceProcessEvents | where FileName =~ "runonce.exe" | project DeviceId, RunOnceTime=TimeGenerated, RunOnceCmd=ProcessCommandLine; KeyCreated | join kind=inner (RunOnce) on DeviceId | where KeyCreateTime between (RunOnceTime - 15m .. RunOnceTime + 30m) | join kind=leftouter (ValuePivot) on DeviceId, ComponentId | extend ComponentName = coalesce(DisplayName, ComponentId) | project TimeCreated=KeyCreateTime, DeviceName, ComponentName, ComponentId, StubPath, CreatedByProcess, CreatedByCommandLine, RunOnceTime, RunOnceCmd | order by TimeCreated desc

DeviceRegistryEvents | where RegistryKey has_cs "Active Setup\\Installed Components" // Look for created keys or values that reference runonce.exe or RunOnce | where ActionType in ("RegistryKeyAdded", "RegistryValueSet", "ValueAdded", "SetValue") or RegistryValueData has_cs "runonce.exe" or RegistryValueData has_cs "RunOnce" | extend Component = extract(@"Installed Components\\([^\\]+)", 1, RegistryKey) | where isnotempty(Component) | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RegistryKey, RegistryValueName, RegistryValueData, Component, ActionType, InitiatingProcessId, ReportId | sort by TimeGenerated desc

DeviceRegistryEvents | where RegistryKey has "Active Setup" and RegistryKey has "Installed Components" | where InitiatingProcessFileName endswith "runonce.exe" or InitiatingProcessCommandLine has "runonce.exe" | extend Parts = split(RegistryKey, "\\") | extend CreatedKey = tostring(Parts[array_length(Parts)-1]) | extend ComponentName = iff( RegistryValueName in ("ComponentName","DisplayName"), RegistryValueData, CreatedKey ) | where isnotempty(ComponentName) | project TimeGenerated, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine, ComponentName | distinct ComponentName

DeviceRegistryEvents | where ActionType in ("RegistryKeyCreated", "RegistryValueSet", "RegistryValueCreated") | where RegistryKey has_any ("HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Active Setup\\Installed Components") | where RegistryValueData has "runonce.exe" or RegistryValueName =~ "StubPath" | extend ComponentName = extract(@"Installed Components\\([^\\]+)", 1, RegistryKey) | project TimeGenerated, DeviceName, ActionType, ComponentName, RegistryKey, RegistryValueName, RegistryValueData | order by TimeGenerated desc

// New Active-Setup component keys created DeviceRegistryEvents | where ActionType == "RegistryKeyCreated" | where RegistryKey has "Active Setup\\Installed Components\\" // covers both HKLM and HKEY_LOCAL_MACHINE forms // Pull the component (sub-key) name that follows …Active Setup\Installed Components\ | extend ComponentName = extract(@"Active Setup\\Installed Components\\([^\\]+)", 1, RegistryKey) | where isnotempty(ComponentName) // Summarise the observation window for every component per device | summarize FirstObserved=min(TimeGenerated), LastObserved=max(TimeGenerated) by ComponentName, DeviceName, DeviceId | order by FirstObserved asc