Detection rules › By event

Defender-DeviceRegistryEvents

Event	Rules
any	2
RegistryKeyDeleted	5
RegistryValueSet	10
RegistryValueDeleted	5
RegistryKeyRenamed	5

any

2 detection rules reference this event. View event page.

Kusto (2)

MosaicLoader severity high T1685
Registry Run Keys - Suspicious Registry Run Keys T1547, T1547.001

RegistryKeyDeleted

5 detection rules reference this event. View event page.

Kusto (5)

Detect Print Processors Registry Driver Key Creation/Modification severity medium T1547
Detect Registry Run Key Creation/Modification severity medium T1112, T1547
Detect Windows Allow Firewall Rule Addition/Modification severity medium T1685
Detect Windows Update Disabled from Registry severity medium T1685
Potential Fodhelper UAC Bypass (ASIM Version) severity medium T1548, T1548.002

RegistryValueSet

10 detection rules reference this event. View event page.

Kusto (10)

COM Registry Key Modified to Point to File in Color Profile Folder severity medium T1574
Component Object Model Hijacking - Vault7 trick severity medium T1546, T1546.015
Detect Print Processors Registry Driver Key Creation/Modification severity medium T1547
Detect Registry Run Key Creation/Modification severity medium T1112, T1547
Detect Windows Allow Firewall Rule Addition/Modification severity medium T1685
Detect Windows Update Disabled from Registry severity medium T1685
MosaicLoader severity high T1685
Potential Fodhelper UAC Bypass (ASIM Version) severity medium T1548, T1548.002
Registry Run Keys - Suspicious Registry Run Keys T1547, T1547.001
Spearphishing Attachment: ISO Images (Microsoft Defender for Endpoint)

RegistryValueDeleted

5 detection rules reference this event. View event page.

Kusto (5)

Detect Print Processors Registry Driver Key Creation/Modification severity medium T1547
Detect Registry Run Key Creation/Modification severity medium T1112, T1547
Detect Windows Allow Firewall Rule Addition/Modification severity medium T1685
Detect Windows Update Disabled from Registry severity medium T1685
Potential Fodhelper UAC Bypass (ASIM Version) severity medium T1548, T1548.002

RegistryKeyRenamed

5 detection rules reference this event. View event page.

Kusto (5)

Detect Print Processors Registry Driver Key Creation/Modification severity medium T1547
Detect Registry Run Key Creation/Modification severity medium T1112, T1547
Detect Windows Allow Firewall Rule Addition/Modification severity medium T1685
Detect Windows Update Disabled from Registry severity medium T1685
Potential Fodhelper UAC Bypass (ASIM Version) severity medium T1548, T1548.002