Defender-DeviceRegistryEvents

ActionType	Title	Sample	Rule
any	Registry activity	Y	Y
RegistryKeyCreated	Registry key created	Y	N
RegistryKeyDeleted	Registry key deleted	Y	Y
RegistryValueSet	Registry value set	Y	Y
RegistryValueDeleted	Registry value deleted	Y	Y
RegistryKeyRenamed	Registry key renamed	N	Y

any: Registry activity

Table: DeviceRegistryEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`ActionType`
`RegistryKey`
`RegistryValueName`
`RegistryValueType`
`RegistryValueData`
`PreviousRegistryValueData`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "RegistryValueSet",
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "system",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessCommandLine": "svchost.exe -k netsvcs -p -s Schedule",
  "InitiatingProcessCreationTime": "2026-08-01T00:56:39.5027656Z",
  "InitiatingProcessFileName": "svchost.exe",
  "InitiatingProcessFileSize": 79920,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\svchost.exe",
  "InitiatingProcessId": 2036,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessIntegrityLevel": "System",
  "InitiatingProcessMD5": "8ec922c7a58a8701ab481b7be9644536",
  "InitiatingProcessParentCreationTime": "2026-08-01T00:56:34.7240107Z",
  "InitiatingProcessParentFileName": "services.exe",
  "InitiatingProcessParentId": 1084,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "3f64c98f22da277a07cab248c44c56eedb796a81",
  "InitiatingProcessSHA256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "TokenElevationTypeDefault",
  "InitiatingProcessUniqueId": "9851624184872996",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Host Process for Windows Services",
  "InitiatingProcessVersionInfoInternalFileName": "svchost.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "svchost.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.22621.1",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "PreviousRegistryValueName": "Actions",
  "RegistryKey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{90834B2B-34D9-4B58-BE3D-C56DC9C710A2}",
  "RegistryValueName": "Actions",
  "RegistryValueType": "Binary",
  "ReportId": 5979,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:19:41.476011Z"
}

Detection Patterns #

Defender-DeviceRegistryEvents any: Registry activityORRegistryValueSet: Registry value set

2 rules

Kusto

Registry Run Keys - Suspicious Registry Run Keys (source)

Cyb3rMonk

MosaicLoader (source)

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`EventType` (kusto rule field)	eq	`RegistryValueSet`	2 rules	kusto
`GlobalPrevalence` (kusto rule field)	is_null		1 rule	kusto
`GlobalPrevalence` (kusto rule field)	lt	`100`	1 rule	kusto
`TargetObject` (kusto rule field)	contains	`\software\microsoft\windows\currentversion\policies\explorer\run`	1 rule	kusto
`parent_process_name` (kusto rule field)	in	`cmd.exe`	1 rule	kusto
`parent_process_name` (kusto rule field)	in	`excel.exe`	1 rule	kusto
`parent_process_name` (kusto rule field)	in	`powerpnt.exe`	1 rule	kusto
`parent_process_name` (kusto rule field)	in	`powershell.exe`	1 rule	kusto
`parent_process_name` (kusto rule field)	in	`winword.exe`	1 rule	kusto

RegistryKeyCreated: Registry key created

Table: DeviceRegistryEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`RegistryKey`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "RegistryKeyCreated",
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "system",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessCommandLine": "svchost.exe -k netsvcs -p -s Schedule",
  "InitiatingProcessCreationTime": "2026-08-01T00:56:39.5027656Z",
  "InitiatingProcessFileName": "svchost.exe",
  "InitiatingProcessFileSize": 79920,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\svchost.exe",
  "InitiatingProcessId": 2036,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessIntegrityLevel": "System",
  "InitiatingProcessMD5": "8ec922c7a58a8701ab481b7be9644536",
  "InitiatingProcessParentCreationTime": "2026-08-01T00:56:34.7240107Z",
  "InitiatingProcessParentFileName": "services.exe",
  "InitiatingProcessParentId": 1084,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "3f64c98f22da277a07cab248c44c56eedb796a81",
  "InitiatingProcessSHA256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "TokenElevationTypeDefault",
  "InitiatingProcessUniqueId": "9851624184872996",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Host Process for Windows Services",
  "InitiatingProcessVersionInfoInternalFileName": "svchost.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "svchost.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.22621.1",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "RegistryKey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{90834B2B-34D9-4B58-BE3D-C56DC9C710A2}",
  "RegistryValueType": "None",
  "ReportId": 5978,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:19:41.4740714Z"
}

RegistryKeyDeleted: Registry key deleted

Table: DeviceRegistryEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`RegistryKey`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "RegistryKeyDeleted",
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "system",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessCommandLine": "\"setup.exe\" --install-archive=\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{35DA5BC7-DF19-4F12-8C18-35B7DE79AC5B}\\MicrosoftEdge_X64_150.0.4078.96_150.0.4078.65.exe\" --previous-version=\"150.0.4078.65\" --mscopilot --verbose-logging --do-not-launch-msedge --system-level --channel=stable --copilot-upgrade-only=1",
  "InitiatingProcessCreationTime": "2026-08-01T08:05:30.1773334Z",
  "InitiatingProcessFileName": "setup.exe",
  "InitiatingProcessFileSize": 5379912,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\program files (x86)\\microsoft\\edgeupdate\\install\\{35da5bc7-df19-4f12-8c18-35b7de79ac5b}\\edgemitmp_112ff.tmp\\setup.exe",
  "InitiatingProcessId": 4356,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessIntegrityLevel": "System",
  "InitiatingProcessMD5": "5dc33a5a93a238e9a8bb4bbd386b711b",
  "InitiatingProcessParentCreationTime": "2026-08-01T08:05:29.5208816Z",
  "InitiatingProcessParentFileName": "MicrosoftEdge_X64_150.0.4078.96_150.0.4078.65.exe",
  "InitiatingProcessParentId": 11580,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "3ff14fb636c40c3d988713cbb59df4a38240a7a3",
  "InitiatingProcessSHA256": "18572bcabd8ada30a2ca9388f3769bcfad950ea115ebebecfa39c28874f25bec",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "TokenElevationTypeDefault",
  "InitiatingProcessUniqueId": "9851624184873434",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Microsoft Edge Installer",
  "InitiatingProcessVersionInfoInternalFileName": "setup_exe",
  "InitiatingProcessVersionInfoOriginalFileName": "setup.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft Edge Installer",
  "InitiatingProcessVersionInfoProductVersion": "150.0.4078.96",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "PreviousRegistryKey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{7A8E2F3C-4B91-4D6E-9C5A-2DF83E1A7B4C}\\LocalServer32",
  "RegistryValueType": "None",
  "ReportId": 4942,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:06:36.0923528Z"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`EventType` (kusto rule field)	in	`RegistryKeyCreated`	5 rules	kusto
`EventType` (kusto rule field)	in	`RegistryValueSet`	5 rules	kusto
`Details` (kusto rule field)	eq	`1`	1 rule	kusto
`ParentImage` (kusto rule field)	ends_with	`cmd.exe`	1 rule	kusto
`ParentImage` (kusto rule field)	ends_with	`powershell.exe`	1 rule	kusto
`ParentImage` (kusto rule field)	ends_with	`powershell_ise.exe`	1 rule	kusto
`TargetObject` (kusto rule field)	contains	`software\classes\ms-settings\shell\open\command`	1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

Potential Fodhelper UAC Bypass (ASIM Version) source medium: This detection looks for the steps required to conduct a UAC bypass using Fodhelper.exe. By default this detection looks for the setting of the required registry keys and the invoking of the process within 1 hour - this can be tweaked as required.T1548, T1548.002↳ also matches RegistryValueSet: Registry value set, RegistryValueDeleted: Registry value deleted, RegistryKeyRenamed: Registry key renamed
Detect Print Processors Registry Driver Key Creation/Modification source medium: This analytic rule detects any registry value creation or modification of print processor registry Driver key. This will load the executable at startup with print spooler service. This could be an indication of a persistence attempt by an adversary.T1547↳ also matches RegistryValueSet: Registry value set, RegistryValueDeleted: Registry value deleted, RegistryKeyRenamed: Registry key renamed
Detect Registry Run Key Creation/Modification source medium: This analytic rule detects any registry value or key creation in the registry run keys. This could be an indication of a persistence attempt by an adversary.T1112, T1547↳ also matches RegistryValueSet: Registry value set, RegistryValueDeleted: Registry value deleted, RegistryKeyRenamed: Registry key renamed

Show 2 more (5 total) on the rules page

RegistryValueSet: Registry value set

Table: DeviceRegistryEvents

Fields #

Name	Description	Rules
`DeviceId`
`Timestamp`
`RegistryKey`
`RegistryValueName`		1 detection rule
`RegistryValueData`
`PreviousRegistryValueData`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "RegistryValueSet",
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "system",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessCommandLine": "svchost.exe -k netsvcs -p -s Schedule",
  "InitiatingProcessCreationTime": "2026-08-01T00:56:39.5027656Z",
  "InitiatingProcessFileName": "svchost.exe",
  "InitiatingProcessFileSize": 79920,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\svchost.exe",
  "InitiatingProcessId": 2036,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessIntegrityLevel": "System",
  "InitiatingProcessMD5": "8ec922c7a58a8701ab481b7be9644536",
  "InitiatingProcessParentCreationTime": "2026-08-01T00:56:34.7240107Z",
  "InitiatingProcessParentFileName": "services.exe",
  "InitiatingProcessParentId": 1084,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "3f64c98f22da277a07cab248c44c56eedb796a81",
  "InitiatingProcessSHA256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "TokenElevationTypeDefault",
  "InitiatingProcessUniqueId": "9851624184872996",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Host Process for Windows Services",
  "InitiatingProcessVersionInfoInternalFileName": "svchost.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "svchost.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.22621.1",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "PreviousRegistryValueName": "Actions",
  "RegistryKey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{90834B2B-34D9-4B58-BE3D-C56DC9C710A2}",
  "RegistryValueName": "Actions",
  "RegistryValueType": "Binary",
  "ReportId": 5979,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:19:41.476011Z"
}

Detection Patterns #

Defender-DeviceRegistryEvents any: Registry activityORRegistryValueSet: Registry value set

2 rules

Kusto

Registry Run Keys - Suspicious Registry Run Keys (source)

Cyb3rMonk

MosaicLoader (source)

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`EventType` (kusto rule field)	eq	`RegistryValueSet`	2 rules	kusto
`EventType` (kusto rule field)	eq	`registryvalueset`	2 rules	kusto
`EventType` (kusto rule field)	in	`RegistryKeyCreated`	5 rules	kusto
`EventType` (kusto rule field)	in	`RegistryValueSet`	5 rules	kusto
`Details` (kusto rule field)	eq	`1`	1 rule	kusto
`GlobalPrevalence` (kusto rule field)	is_null		1 rule	kusto
`GlobalPrevalence` (kusto rule field)	lt	`100`	1 rule	kusto
`ParentImage` (kusto rule field)	ends_with	`cmd.exe`	1 rule	kusto
`ParentImage` (kusto rule field)	ends_with	`powershell.exe`	1 rule	kusto
`ParentImage` (kusto rule field)	ends_with	`powershell_ise.exe`	1 rule	kusto
`TargetObject` (kusto rule field)	contains	`\software\microsoft\windows\currentversion\policies\explorer\run`	1 rule	kusto
`TargetObject` (kusto rule field)	contains	`software\classes\ms-settings\shell\open\command`	1 rule	kusto
`parent_process_name` (kusto rule field)	in	`cmd.exe`	1 rule	kusto
`parent_process_name` (kusto rule field)	in	`powershell.exe`	1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

COM Registry Key Modified to Point to File in Color Profile Folder source medium: This query looks for changes to COM registry keys to point to files in C:\Windows\System32\spool\drivers\color. This can be used to enable COM hijacking for persistence. Ref: https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/T1574
Potential Fodhelper UAC Bypass (ASIM Version) source medium: This detection looks for the steps required to conduct a UAC bypass using Fodhelper.exe. By default this detection looks for the setting of the required registry keys and the invoking of the process within 1 hour - this can be tweaked as required.T1548, T1548.002↳ also matches RegistryKeyDeleted: Registry key deleted, RegistryValueDeleted: Registry value deleted, RegistryKeyRenamed: Registry key renamed
Component Object Model Hijacking - Vault7 trick source medium: This detection looks for the very specific value of "Attribute" in the "ShellFolder" CLSID of a COM object. This value (0xf090013d) seems to only link back to this specific persistence method. The blog post linked here (https://www.ired.team/offensive-security/code-execution/forcing-iexplore.exe-to-load-a-malicious-dll-via-com-abuse) provides more background on the meaning of this value.T1546, T1546.015

Show 5 more (8 total) on the rules page

RegistryValueDeleted: Registry value deleted

Table: DeviceRegistryEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`RegistryKey`
`RegistryValueName`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "RegistryValueDeleted",
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "system",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessCommandLine": "services.exe",
  "InitiatingProcessCreationTime": "2026-08-01T00:56:34.7240107Z",
  "InitiatingProcessFileName": "services.exe",
  "InitiatingProcessFileSize": 757696,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\services.exe",
  "InitiatingProcessId": 1084,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessIntegrityLevel": "System",
  "InitiatingProcessMD5": "9231a3bd3ea5897debe82603f180b862",
  "InitiatingProcessParentCreationTime": "2026-08-01T00:56:34.5728316Z",
  "InitiatingProcessParentFileName": "wininit.exe",
  "InitiatingProcessParentId": 968,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "dd9c3adcafca8ac9b61816120961baed5b0158e4",
  "InitiatingProcessSHA256": "f58b4b4f816d81eb1d1f6b4931e7620f24bb0ad96d576535769fdb56ede8aec2",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "TokenElevationTypeDefault",
  "InitiatingProcessUniqueId": "9851624184872971",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Services and Controller app",
  "InitiatingProcessVersionInfoInternalFileName": "services.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "services.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.22621.5415",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "PreviousRegistryKey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\MicrosoftCopilotElevationService",
  "PreviousRegistryValueData": "Provides elevated privileges for Microsoft Copilot.",
  "PreviousRegistryValueName": "Description",
  "RegistryValueType": "None",
  "ReportId": 4947,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:06:36.1056209Z"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`EventType` (kusto rule field)	in	`RegistryKeyCreated`	5 rules	kusto
`EventType` (kusto rule field)	in	`RegistryValueSet`	5 rules	kusto
`Details` (kusto rule field)	eq	`1`	1 rule	kusto
`ParentImage` (kusto rule field)	ends_with	`cmd.exe`	1 rule	kusto
`ParentImage` (kusto rule field)	ends_with	`powershell.exe`	1 rule	kusto
`ParentImage` (kusto rule field)	ends_with	`powershell_ise.exe`	1 rule	kusto
`TargetObject` (kusto rule field)	contains	`software\classes\ms-settings\shell\open\command`	1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

Potential Fodhelper UAC Bypass (ASIM Version) source medium: This detection looks for the steps required to conduct a UAC bypass using Fodhelper.exe. By default this detection looks for the setting of the required registry keys and the invoking of the process within 1 hour - this can be tweaked as required.T1548, T1548.002↳ also matches RegistryKeyDeleted: Registry key deleted, RegistryValueSet: Registry value set, RegistryKeyRenamed: Registry key renamed
Detect Print Processors Registry Driver Key Creation/Modification source medium: This analytic rule detects any registry value creation or modification of print processor registry Driver key. This will load the executable at startup with print spooler service. This could be an indication of a persistence attempt by an adversary.T1547↳ also matches RegistryKeyDeleted: Registry key deleted, RegistryValueSet: Registry value set, RegistryKeyRenamed: Registry key renamed
Detect Registry Run Key Creation/Modification source medium: This analytic rule detects any registry value or key creation in the registry run keys. This could be an indication of a persistence attempt by an adversary.T1112, T1547↳ also matches RegistryKeyDeleted: Registry key deleted, RegistryValueSet: Registry value set, RegistryKeyRenamed: Registry key renamed

Show 2 more (5 total) on the rules page

RegistryKeyRenamed: Registry key renamed

Table: DeviceRegistryEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`RegistryKey`
`PreviousRegistryKey`
`InitiatingProcessFileName`

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`EventType` (kusto rule field)	in	`RegistryKeyCreated`	5 rules	kusto
`EventType` (kusto rule field)	in	`RegistryValueSet`	5 rules	kusto
`Details` (kusto rule field)	eq	`1`	1 rule	kusto
`ParentImage` (kusto rule field)	ends_with	`cmd.exe`	1 rule	kusto
`ParentImage` (kusto rule field)	ends_with	`powershell.exe`	1 rule	kusto
`ParentImage` (kusto rule field)	ends_with	`powershell_ise.exe`	1 rule	kusto
`TargetObject` (kusto rule field)	contains	`software\classes\ms-settings\shell\open\command`	1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

Potential Fodhelper UAC Bypass (ASIM Version) source medium: This detection looks for the steps required to conduct a UAC bypass using Fodhelper.exe. By default this detection looks for the setting of the required registry keys and the invoking of the process within 1 hour - this can be tweaked as required.T1548, T1548.002↳ also matches RegistryKeyDeleted: Registry key deleted, RegistryValueSet: Registry value set, RegistryValueDeleted: Registry value deleted
Detect Print Processors Registry Driver Key Creation/Modification source medium: This analytic rule detects any registry value creation or modification of print processor registry Driver key. This will load the executable at startup with print spooler service. This could be an indication of a persistence attempt by an adversary.T1547↳ also matches RegistryKeyDeleted: Registry key deleted, RegistryValueSet: Registry value set, RegistryValueDeleted: Registry value deleted
Detect Registry Run Key Creation/Modification source medium: This analytic rule detects any registry value or key creation in the registry run keys. This could be an indication of a persistence attempt by an adversary.T1112, T1547↳ also matches RegistryKeyDeleted: Registry key deleted, RegistryValueSet: Registry value set, RegistryValueDeleted: Registry value deleted

Show 2 more (5 total) on the rules page

Defender-DeviceRegistryEvents

any: Registry activity

Fields #

Example Event #

Detection Patterns #

Kusto

Common Indicators #

RegistryKeyCreated: Registry key created

Fields #

Example Event #

RegistryKeyDeleted: Registry key deleted

Fields #

Example Event #

Common Indicators #

Detection Rules #

Kusto #

RegistryValueSet: Registry value set

Fields #

Example Event #

Detection Patterns #

Kusto

Common Indicators #

Detection Rules #

Kusto #

Related Events #

RegistryValueDeleted: Registry value deleted

Fields #

Example Event #

Common Indicators #

Detection Rules #

Kusto #

RegistryKeyRenamed: Registry key renamed

Fields #

Common Indicators #

Detection Rules #

Kusto #

References #