Defender-DeviceRegistryEvents

ActionType	Title	Sample	Rule
any	Registry activity	Y	Y
RegistryKeyCreated	Registry key created	Y	N
RegistryKeyDeleted	Registry key deleted	Y	Y
RegistryValueSet	Registry value set	Y	Y
RegistryValueDeleted	Registry value deleted	Y	Y
RegistryKeyRenamed	Registry key renamed	N	Y

any: Registry activity

Table: DeviceRegistryEvents

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`ActionType`	2 detection rules	Kusto
`RegistryKey`	2 detection rules	Kusto
`InitiatingProcessFileName`	1 detection rule	Kusto
`RegistryValueData`	1 detection rule	Kusto
`RegistryValueName`	1 detection rule	Kusto

Example Event #

{
  "ActionType": "RegistryValueSet",
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "system",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessCommandLine": "svchost.exe -k netsvcs -p -s Schedule",
  "InitiatingProcessCreationTime": "2026-08-01T00:56:39.5027656Z",
  "InitiatingProcessFileName": "svchost.exe",
  "InitiatingProcessFileSize": 79920,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\svchost.exe",
  "InitiatingProcessId": 2036,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessIntegrityLevel": "System",
  "InitiatingProcessMD5": "8ec922c7a58a8701ab481b7be9644536",
  "InitiatingProcessParentCreationTime": "2026-08-01T00:56:34.7240107Z",
  "InitiatingProcessParentFileName": "services.exe",
  "InitiatingProcessParentId": 1084,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "3f64c98f22da277a07cab248c44c56eedb796a81",
  "InitiatingProcessSHA256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "TokenElevationTypeDefault",
  "InitiatingProcessUniqueId": "9851624184872996",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Host Process for Windows Services",
  "InitiatingProcessVersionInfoInternalFileName": "svchost.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "svchost.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.22621.1",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "PreviousRegistryValueName": "Actions",
  "RegistryKey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{90834B2B-34D9-4B58-BE3D-C56DC9C710A2}",
  "RegistryValueName": "Actions",
  "RegistryValueType": "Binary",
  "ReportId": 5979,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:19:41.476011Z"
}

Detection Patterns #

Defender-DeviceRegistryEvents any: Registry activityORRegistryValueSet: Registry value set

2 rules

Kusto

Registry Run Keys - Suspicious Registry Run Keys (source)

Cyb3rMonk

MosaicLoader (source)

Common Indicators #

Positive field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

Field	Kind	Value	Rules	Vendors
`EventType` (kusto rule field)	eq	`RegistryValueSet`	2 rules	kusto
`GlobalPrevalence` (kusto rule field)	is_null		1 rule	kusto
`GlobalPrevalence` (kusto rule field)	lt	`100`	1 rule	kusto
`TargetObject` (kusto rule field)	contains	`\software\microsoft\windows\currentversion\policies\explorer\run`	1 rule	kusto
`parent_process_name` (kusto rule field)	in	`cmd.exe`	1 rule	kusto
`parent_process_name` (kusto rule field)	in	`excel.exe`	1 rule	kusto
`parent_process_name` (kusto rule field)	in	`powerpnt.exe`	1 rule	kusto
`parent_process_name` (kusto rule field)	in	`powershell.exe`	1 rule	kusto
`parent_process_name` (kusto rule field)	in	`winword.exe`	1 rule	kusto

RegistryKeyCreated: Registry key created

Table: DeviceRegistryEvents

Example Event #

{
  "ActionType": "RegistryKeyCreated",
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "system",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessCommandLine": "svchost.exe -k netsvcs -p -s Schedule",
  "InitiatingProcessCreationTime": "2026-08-01T00:56:39.5027656Z",
  "InitiatingProcessFileName": "svchost.exe",
  "InitiatingProcessFileSize": 79920,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\svchost.exe",
  "InitiatingProcessId": 2036,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessIntegrityLevel": "System",
  "InitiatingProcessMD5": "8ec922c7a58a8701ab481b7be9644536",
  "InitiatingProcessParentCreationTime": "2026-08-01T00:56:34.7240107Z",
  "InitiatingProcessParentFileName": "services.exe",
  "InitiatingProcessParentId": 1084,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "3f64c98f22da277a07cab248c44c56eedb796a81",
  "InitiatingProcessSHA256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "TokenElevationTypeDefault",
  "InitiatingProcessUniqueId": "9851624184872996",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Host Process for Windows Services",
  "InitiatingProcessVersionInfoInternalFileName": "svchost.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "svchost.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.22621.1",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "RegistryKey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{90834B2B-34D9-4B58-BE3D-C56DC9C710A2}",
  "RegistryValueType": "None",
  "ReportId": 5978,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:19:41.4740714Z"
}

RegistryKeyDeleted: Registry key deleted

Table: DeviceRegistryEvents

Example Event #

{
  "ActionType": "RegistryKeyDeleted",
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "system",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessCommandLine": "\"setup.exe\" --install-archive=\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{35DA5BC7-DF19-4F12-8C18-35B7DE79AC5B}\\MicrosoftEdge_X64_150.0.4078.96_150.0.4078.65.exe\" --previous-version=\"150.0.4078.65\" --mscopilot --verbose-logging --do-not-launch-msedge --system-level --channel=stable --copilot-upgrade-only=1",
  "InitiatingProcessCreationTime": "2026-08-01T08:05:30.1773334Z",
  "InitiatingProcessFileName": "setup.exe",
  "InitiatingProcessFileSize": 5379912,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\program files (x86)\\microsoft\\edgeupdate\\install\\{35da5bc7-df19-4f12-8c18-35b7de79ac5b}\\edgemitmp_112ff.tmp\\setup.exe",
  "InitiatingProcessId": 4356,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessIntegrityLevel": "System",
  "InitiatingProcessMD5": "5dc33a5a93a238e9a8bb4bbd386b711b",
  "InitiatingProcessParentCreationTime": "2026-08-01T08:05:29.5208816Z",
  "InitiatingProcessParentFileName": "MicrosoftEdge_X64_150.0.4078.96_150.0.4078.65.exe",
  "InitiatingProcessParentId": 11580,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "3ff14fb636c40c3d988713cbb59df4a38240a7a3",
  "InitiatingProcessSHA256": "18572bcabd8ada30a2ca9388f3769bcfad950ea115ebebecfa39c28874f25bec",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "TokenElevationTypeDefault",
  "InitiatingProcessUniqueId": "9851624184873434",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Microsoft Edge Installer",
  "InitiatingProcessVersionInfoInternalFileName": "setup_exe",
  "InitiatingProcessVersionInfoOriginalFileName": "setup.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft Edge Installer",
  "InitiatingProcessVersionInfoProductVersion": "150.0.4078.96",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "PreviousRegistryKey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{7A8E2F3C-4B91-4D6E-9C5A-2DF83E1A7B4C}\\LocalServer32",
  "RegistryValueType": "None",
  "ReportId": 4942,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:06:36.0923528Z"
}

Common Indicators #

Field	Kind	Value	Rules	Vendors
`EventType` (kusto rule field)	in	`RegistryKeyCreated`	5 rules	kusto
`EventType` (kusto rule field)	in	`RegistryValueSet`	5 rules	kusto
`Details` (kusto rule field)	eq	`1`	1 rule	kusto
`ParentImage` (kusto rule field)	ends_with	`cmd.exe`	1 rule	kusto
`ParentImage` (kusto rule field)	ends_with	`powershell.exe`	1 rule	kusto
`ParentImage` (kusto rule field)	ends_with	`powershell_ise.exe`	1 rule	kusto
`TargetObject` (kusto rule field)	contains	`software\classes\ms-settings\shell\open\command`	1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

Potential Fodhelper UAC Bypass (ASIM Version) source medium: This detection looks for the steps required to conduct a UAC bypass using Fodhelper.exe. By default this detection looks for the setting of the required registry keys and the invoking of the process within 1 hour - this can be tweaked as required.T1548, T1548.002↳ also matches RegistryValueSet: Registry value set, RegistryValueDeleted: Registry value deleted, RegistryKeyRenamed: Registry key renamed
Detect Print Processors Registry Driver Key Creation/Modification source medium: This analytic rule detects any registry value creation or modification of print processor registry Driver key. This will load the executable at startup with print spooler service. This could be an indication of a persistence attempt by an adversary.T1547↳ also matches RegistryValueSet: Registry value set, RegistryValueDeleted: Registry value deleted, RegistryKeyRenamed: Registry key renamed
Detect Registry Run Key Creation/Modification source medium: This analytic rule detects any registry value or key creation in the registry run keys. This could be an indication of a persistence attempt by an adversary.T1112, T1547↳ also matches RegistryValueSet: Registry value set, RegistryValueDeleted: Registry value deleted, RegistryKeyRenamed: Registry key renamed

Show 2 more (5 total) on the rules page

RegistryValueSet: Registry value set

Table: DeviceRegistryEvents

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`ActionType`	5 detection rules	Kusto
`RegistryKey`	5 detection rules	Kusto
`RegistryValueData`	3 detection rules	Kusto
`RegistryValueName`	3 detection rules	Kusto
`InitiatingProcessFileName`	1 detection rule	Kusto

Example Event #

{
  "ActionType": "RegistryValueSet",
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "system",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessCommandLine": "svchost.exe -k netsvcs -p -s Schedule",
  "InitiatingProcessCreationTime": "2026-08-01T00:56:39.5027656Z",
  "InitiatingProcessFileName": "svchost.exe",
  "InitiatingProcessFileSize": 79920,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\svchost.exe",
  "InitiatingProcessId": 2036,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessIntegrityLevel": "System",
  "InitiatingProcessMD5": "8ec922c7a58a8701ab481b7be9644536",
  "InitiatingProcessParentCreationTime": "2026-08-01T00:56:34.7240107Z",
  "InitiatingProcessParentFileName": "services.exe",
  "InitiatingProcessParentId": 1084,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "3f64c98f22da277a07cab248c44c56eedb796a81",
  "InitiatingProcessSHA256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "TokenElevationTypeDefault",
  "InitiatingProcessUniqueId": "9851624184872996",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Host Process for Windows Services",
  "InitiatingProcessVersionInfoInternalFileName": "svchost.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "svchost.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.22621.1",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "PreviousRegistryValueName": "Actions",
  "RegistryKey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{90834B2B-34D9-4B58-BE3D-C56DC9C710A2}",
  "RegistryValueName": "Actions",
  "RegistryValueType": "Binary",
  "ReportId": 5979,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:19:41.476011Z"
}

Detection Patterns #

Defender-DeviceRegistryEvents any: Registry activityORRegistryValueSet: Registry value set

2 rules

Kusto

Registry Run Keys - Suspicious Registry Run Keys (source)

Cyb3rMonk

MosaicLoader (source)

Common Indicators #

Field	Kind	Value	Rules	Vendors
`EventType` (kusto rule field)	eq	`RegistryValueSet`	2 rules	kusto
`EventType` (kusto rule field)	eq	`registryvalueset`	2 rules	kusto
`EventType` (kusto rule field)	in	`RegistryKeyCreated`	5 rules	kusto
`EventType` (kusto rule field)	in	`RegistryValueSet`	5 rules	kusto
`Details` (kusto rule field)	eq	`1`	1 rule	kusto
`GlobalPrevalence` (kusto rule field)	is_null		1 rule	kusto
`GlobalPrevalence` (kusto rule field)	lt	`100`	1 rule	kusto
`ParentImage` (kusto rule field)	ends_with	`cmd.exe`	1 rule	kusto
`ParentImage` (kusto rule field)	ends_with	`powershell.exe`	1 rule	kusto
`ParentImage` (kusto rule field)	ends_with	`powershell_ise.exe`	1 rule	kusto
`TargetObject` (kusto rule field)	contains	`\software\microsoft\windows\currentversion\policies\explorer\run`	1 rule	kusto
`TargetObject` (kusto rule field)	contains	`software\classes\ms-settings\shell\open\command`	1 rule	kusto
`parent_process_name` (kusto rule field)	in	`cmd.exe`	1 rule	kusto
`parent_process_name` (kusto rule field)	in	`powershell.exe`	1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

COM Registry Key Modified to Point to File in Color Profile Folder source medium: This query looks for changes to COM registry keys to point to files in C:\Windows\System32\spool\drivers\color. This can be used to enable COM hijacking for persistence. Ref: https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/T1574
Potential Fodhelper UAC Bypass (ASIM Version) source medium: This detection looks for the steps required to conduct a UAC bypass using Fodhelper.exe. By default this detection looks for the setting of the required registry keys and the invoking of the process within 1 hour - this can be tweaked as required.T1548, T1548.002↳ also matches RegistryKeyDeleted: Registry key deleted, RegistryValueDeleted: Registry value deleted, RegistryKeyRenamed: Registry key renamed
Component Object Model Hijacking - Vault7 trick source medium: This detection looks for the very specific value of "Attribute" in the "ShellFolder" CLSID of a COM object. This value (0xf090013d) seems to only link back to this specific persistence method. The blog post linked here (https://www.ired.team/offensive-security/code-execution/forcing-iexplore.exe-to-load-a-malicious-dll-via-com-abuse) provides more background on the meaning of this value.T1546, T1546.015

Show 5 more (8 total) on the rules page

RegistryValueDeleted: Registry value deleted

Table: DeviceRegistryEvents

Example Event #

{
  "ActionType": "RegistryValueDeleted",
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "system",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessCommandLine": "services.exe",
  "InitiatingProcessCreationTime": "2026-08-01T00:56:34.7240107Z",
  "InitiatingProcessFileName": "services.exe",
  "InitiatingProcessFileSize": 757696,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\services.exe",
  "InitiatingProcessId": 1084,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessIntegrityLevel": "System",
  "InitiatingProcessMD5": "9231a3bd3ea5897debe82603f180b862",
  "InitiatingProcessParentCreationTime": "2026-08-01T00:56:34.5728316Z",
  "InitiatingProcessParentFileName": "wininit.exe",
  "InitiatingProcessParentId": 968,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "dd9c3adcafca8ac9b61816120961baed5b0158e4",
  "InitiatingProcessSHA256": "f58b4b4f816d81eb1d1f6b4931e7620f24bb0ad96d576535769fdb56ede8aec2",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "TokenElevationTypeDefault",
  "InitiatingProcessUniqueId": "9851624184872971",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Services and Controller app",
  "InitiatingProcessVersionInfoInternalFileName": "services.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "services.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.22621.5415",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "PreviousRegistryKey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\MicrosoftCopilotElevationService",
  "PreviousRegistryValueData": "Provides elevated privileges for Microsoft Copilot.",
  "PreviousRegistryValueName": "Description",
  "RegistryValueType": "None",
  "ReportId": 4947,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:06:36.1056209Z"
}

Common Indicators #

Field	Kind	Value	Rules	Vendors
`EventType` (kusto rule field)	in	`RegistryKeyCreated`	5 rules	kusto
`EventType` (kusto rule field)	in	`RegistryValueSet`	5 rules	kusto
`Details` (kusto rule field)	eq	`1`	1 rule	kusto
`ParentImage` (kusto rule field)	ends_with	`cmd.exe`	1 rule	kusto
`ParentImage` (kusto rule field)	ends_with	`powershell.exe`	1 rule	kusto
`ParentImage` (kusto rule field)	ends_with	`powershell_ise.exe`	1 rule	kusto
`TargetObject` (kusto rule field)	contains	`software\classes\ms-settings\shell\open\command`	1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

Potential Fodhelper UAC Bypass (ASIM Version) source medium: This detection looks for the steps required to conduct a UAC bypass using Fodhelper.exe. By default this detection looks for the setting of the required registry keys and the invoking of the process within 1 hour - this can be tweaked as required.T1548, T1548.002↳ also matches RegistryKeyDeleted: Registry key deleted, RegistryValueSet: Registry value set, RegistryKeyRenamed: Registry key renamed
Detect Print Processors Registry Driver Key Creation/Modification source medium: This analytic rule detects any registry value creation or modification of print processor registry Driver key. This will load the executable at startup with print spooler service. This could be an indication of a persistence attempt by an adversary.T1547↳ also matches RegistryKeyDeleted: Registry key deleted, RegistryValueSet: Registry value set, RegistryKeyRenamed: Registry key renamed
Detect Registry Run Key Creation/Modification source medium: This analytic rule detects any registry value or key creation in the registry run keys. This could be an indication of a persistence attempt by an adversary.T1112, T1547↳ also matches RegistryKeyDeleted: Registry key deleted, RegistryValueSet: Registry value set, RegistryKeyRenamed: Registry key renamed

Show 2 more (5 total) on the rules page

RegistryKeyRenamed: Registry key renamed

Table: DeviceRegistryEvents

Common Indicators #

Field	Kind	Value	Rules	Vendors
`EventType` (kusto rule field)	in	`RegistryKeyCreated`	5 rules	kusto
`EventType` (kusto rule field)	in	`RegistryValueSet`	5 rules	kusto
`Details` (kusto rule field)	eq	`1`	1 rule	kusto
`ParentImage` (kusto rule field)	ends_with	`cmd.exe`	1 rule	kusto
`ParentImage` (kusto rule field)	ends_with	`powershell.exe`	1 rule	kusto
`ParentImage` (kusto rule field)	ends_with	`powershell_ise.exe`	1 rule	kusto
`TargetObject` (kusto rule field)	contains	`software\classes\ms-settings\shell\open\command`	1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

Potential Fodhelper UAC Bypass (ASIM Version) source medium: This detection looks for the steps required to conduct a UAC bypass using Fodhelper.exe. By default this detection looks for the setting of the required registry keys and the invoking of the process within 1 hour - this can be tweaked as required.T1548, T1548.002↳ also matches RegistryKeyDeleted: Registry key deleted, RegistryValueSet: Registry value set, RegistryValueDeleted: Registry value deleted
Detect Print Processors Registry Driver Key Creation/Modification source medium: This analytic rule detects any registry value creation or modification of print processor registry Driver key. This will load the executable at startup with print spooler service. This could be an indication of a persistence attempt by an adversary.T1547↳ also matches RegistryKeyDeleted: Registry key deleted, RegistryValueSet: Registry value set, RegistryValueDeleted: Registry value deleted
Detect Registry Run Key Creation/Modification source medium: This analytic rule detects any registry value or key creation in the registry run keys. This could be an indication of a persistence attempt by an adversary.T1112, T1547↳ also matches RegistryKeyDeleted: Registry key deleted, RegistryValueSet: Registry value set, RegistryValueDeleted: Registry value deleted

Show 2 more (5 total) on the rules page

Defender-DeviceRegistryEvents

any: Registry activity

Detection Fields #

Example Event #

Detection Patterns #

Kusto

Common Indicators #

RegistryKeyCreated: Registry key created

Example Event #

RegistryKeyDeleted: Registry key deleted

Example Event #

Common Indicators #

Detection Rules #

Kusto #

RegistryValueSet: Registry value set

Detection Fields #

Example Event #

Detection Patterns #

Kusto

Common Indicators #

Detection Rules #

Kusto #

Related Events #

RegistryValueDeleted: Registry value deleted

Example Event #

Common Indicators #

Detection Rules #

Kusto #

RegistryKeyRenamed: Registry key renamed

Common Indicators #

Detection Rules #

Kusto #

References #