DeviceRegistryEvents

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Tables Index

---

Creation and modification of registry entries

Attribute	Value
Category	MDE
Basic Logs Eligible	✓ Yes (source)
Supports Transformations	✓ Yes (source)
Ingestion API Supported	✗ No
Azure Monitor Tables Reference	View Documentation
Defender XDR Advanced Hunting Schema	View Documentation

Contents

• Schema
• Solutions
• Connectors
• Content Items
• Parsers

Schema (49 columns)

Source: Azure Monitor documentation

Column Name	Type	Description
_BilledSize	real	The record size in bytes
_IsBillable	string	Specifies whether ingesting the data is billable. When _IsBillable isfalseingestion isn't billed to your Azure account
ActionType	string	Type of activity that triggered the event.
AppGuardContainerId	string	Identifier for the virtualized container used by Application Guard to isolate browser activity.
DeviceId	string	Unique identifier for the device in the service.
DeviceName	string	Fully qualified domain name (FQDN) of the device.
InitiatingProcessAccountDomain	string	Domain of the account that ran the initiating process.
InitiatingProcessAccountName	string	User name of the account that ran the initiating process.
InitiatingProcessAccountObjectId	string	Azure AD object ID of the user account that ran the initiating process.
InitiatingProcessAccountSid	string	Security Identifier (SID) of the account that ran the initiating process.
InitiatingProcessAccountUpn	string	User principal name (UPN) of the account that ran the initiating process.
InitiatingProcessCommandLine	string	Command line used to run the initiating process.
InitiatingProcessCreationTime	datetime	Date and time when the process that initiated the event was started.
InitiatingProcessFileName	string	Name of the initiating process.
InitiatingProcessFileSize	long	The size of the file (bytes) that ran the process responsible for the event.
InitiatingProcessFolderPath	string	Folder containing the initiating process (image file).
InitiatingProcessId	long	Process ID (PID) of the initiating process.
InitiatingProcessIntegrityLevel	string	Integrity level of the initiating process. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources..
InitiatingProcessMD5	string	MD5 hash of the initiating process (image file).
InitiatingProcessParentCreationTime	datetime	Date and time when the parent of the process responsible for the event was started.
InitiatingProcessParentFileName	string	Name of the parent process that spawned the initiating process.
InitiatingProcessParentId	long	Process ID (PID) of the parent process that spawned the initiating process.
InitiatingProcessRemoteSessionDeviceName	string	Device name of the remote device from which the initiating process's RDP session was initiated.
InitiatingProcessRemoteSessionIP	string	IP address of the remote device from which the initiating process's RDP session was initiated.
InitiatingProcessSessionId	long	Windows session ID of the initiating process.
InitiatingProcessSHA1	string	SHA-1 hash of the initiating process (image file).
InitiatingProcessSHA256	string	SHA-256 hash of the initiating process (image file). In some cases this column may not be populated - please use the InitiatingProcessSHA1 column instead.
InitiatingProcessTokenElevation	string	Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the initiating process.
InitiatingProcessUniqueId	string	Unique identifier of the initiating process; this is equal to the Process Start Key in Windows devices.
InitiatingProcessVersionInfoCompanyName	string	The company name in version information (image file) responsible for the event.
InitiatingProcessVersionInfoFileDescription	string	The description in version information (image file) responsible for the event.
InitiatingProcessVersionInfoInternalFileName	string	The internal file name in version information (image file) responsible for the event.
InitiatingProcessVersionInfoOriginalFileName	string	The original file name in version information (image file) responsible for the event.
InitiatingProcessVersionInfoProductName	string	The product name in version information (image file) responsible for the event.
InitiatingProcessVersionInfoProductVersion	string	The product version in version information (image file) responsible for the event.
IsInitiatingProcessRemoteSession	bool	Indicates whether the initiating process was run under a remote desktop protocol (RDP) session (true) or locally (false).
MachineGroup	string	Machine group of the machine. This group is used by role-based access control to determine access to the machine.
PreviousRegistryKey	string	Original registry key before it was modified.
PreviousRegistryValueData	string	Original data of the registry value before it was modified.
PreviousRegistryValueName	string	Original name of the registry value before it was modified.
RegistryKey	string	Registry key that the recorded action was applied to.
RegistryValueData	string	Data of the registry value that the recorded action was applied to.
RegistryValueName	string	Name of the registry value that the recorded action was applied to.
RegistryValueType	string	Data type, such as binary or string, of the registry value that the recorded action was applied to.
ReportId	long	Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns..
SourceSystem	string	The type of agent the event was collected by. For example,OpsManagerfor Windows agent, either direct connect or Operations Manager,Linuxfor all Linux agents, orAzurefor Azure Diagnostics
TenantId	string	The Log Analytics workspace ID
TimeGenerated	datetime	Date and time the event was recorded by the MDE agent on the endpoint.
Type	string	The name of the table

Solutions (4)

This table is used by the following solutions:

• FalconFriday
• Microsoft Defender XDR
• Standalone Content
• ZeroTrust(TIC3.0)

Connectors (1)

This table is ingested by the following connectors:

Selection Criteria: ActionType == "RegistryValueSet"

Connector
Microsoft Defender XDR

---

Content Items Using This Table (26)

Analytic Rules (3)

In solution FalconFriday: ActionType == "RegistryValueSet"

Analytic Rule
Component Object Model Hijacking - Vault7 trick

In solution Microsoft Defender XDR: ActionType == "RegistryValueSet"

Analytic Rule
MosaicLoader

Standalone Content: ActionType == "RegistryValueSet"

Analytic Rule
COM Registry Key Modified to Point to File in Color Profile Folder

Hunting Queries (19)

In solution Microsoft Defender XDR: ActionType == "RegistryValueSet"

Hunting Query
MosaicLoader

Standalone Content:

Hunting Query	Selection Criteria
MDE_FindMountedISOandDriveLetters
MDE_ProxyChangesViaRegistry

GitHub Only:

Hunting Query	Selection Criteria
Accessibility Features
Baseline Comparison
KNOTWEED-COM Registry Key Modified to Point to Color Profile Folder	ActionType == "RegistryValueSet"
MosaicLoader	ActionType == "RegistryValueSet"
OceanLotus registry activity	ActionType == "RegistryValueSet"
RunMRU with non-ASCII characters	ActionType == "RegistryValueSet"
Services
Suspicious Registry Keys
detect-impacket-atexec	ActionType in "NamedPipeEvent,RegistryKeyCreated"
qakbot-campaign-registry-edit	ActionType == "RegistryValueSet"
rare_sch_task_with_activity
suspicious-base64-encoded-registry-keys	ActionType has_any "RegistryKeyCreated,RegistryValueSet"
suspicious-command-interpreters-added-to-registry	ActionType has_any "RegistryKeyCreated,RegistryValueSet"
suspicious-keywords-in-registry	ActionType has_any "RegistryKeyCreated,RegistryValueSet"
wadhrama-credential-dump
wdigest-caching

Workbooks (4)

In solution Microsoft Defender XDR:

Workbook	Selection Criteria
MicrosoftDefenderForEndPoint

In solution ZeroTrust(TIC3.0):

Workbook	Selection Criteria
ZeroTrustTIC3

GitHub Only:

Workbook	Selection Criteria
MicrosoftDefenderForEndPoint
MicrosoftSentinelDeploymentandMigrationTracker

Parsers Using This Table (1)

ASIM Parsers (1) — Selection Criteria: ActionType in "RegistryKeyDeleted,RegistryKeyRenamed,RegistryValueDeleted,RegistryValueSet"

Parser	Schema	Product
ASimRegistryEventMicrosoft365D	RegistryEvent	Microsoft 365 Defender for Endpoint

Selection Criteria Summary (4 criteria, 15 total references)

References by type: 1 connectors, 13 content items, 1 ASIM parsers, 0 other parsers.

Selection Criteria	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
ActionType == "RegistryValueSet"	1	9	-	-	10
ActionType has_any "RegistryKeyCreated,RegistryValueSet"	-	3	-	-	3
ActionType in "NamedPipeEvent,RegistryKeyCreated"	-	1	-	-	1
ActionType in "RegistryKeyDeleted,RegistryKeyRenamed,RegistryValueDeleted,RegistryValueSet"	-	-	1	-	1
Total	1	13	1	0	15

ActionType

Value	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
RegistryValueSet	1	9	1	-	11
has_any RegistryKeyCreated	-	3	-	-	3
has_any RegistryValueSet	-	3	-	-	3
NamedPipeEvent	-	1	-	-	1
RegistryKeyCreated	-	1	-	-	1
RegistryKeyDeleted	-	-	1	-	1
RegistryKeyRenamed	-	-	1	-	1
RegistryValueDeleted	-	-	1	-	1

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Tables Index