Lesson 147 — A New Registry Run Key Appeared

Case briefing

Stage 1 — find Run and RunOnce changes

Begin with the known device and time window. Search DeviceRegistryEvents for changes under common Run and RunOnce paths while keeping the initiating-process context visible.

let TargetDevice = "WS-FIN-042";
let TargetTime = datetime(2026-08-18 01:24:03);
DeviceRegistryEvents
| where DeviceName =~ TargetDevice
| where Timestamp between (TargetTime - 5m .. TargetTime + 10m)
| where RegistryKey has_any (
    @"\Software\Microsoft\Windows\CurrentVersion\Run",
    @"\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)
| project Timestamp,
          ActionType,
          RegistryKey,
          RegistryValueName,
          RegistryValueData,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine,
          InitiatingProcessId,
          InitiatingProcessAccountName
| order by Timestamp asc

Stage 2 — follow the suspicious registry value

Once a distinctive value name is identified, follow its history on the device. Preserve both current and previous value data where available so changes are not mistaken for first-time creation.

let TargetDevice = "WS-FIN-042";
let TargetValueName = "UpdateCheck";
DeviceRegistryEvents
| where DeviceName =~ TargetDevice
| where RegistryValueName =~ TargetValueName
| project Timestamp,
          ActionType,
          RegistryKey,
          RegistryValueName,
          RegistryValueData,
          PreviousRegistryValueData,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine,
          InitiatingProcessId,
          InitiatingProcessAccountName
| order by Timestamp asc

Stage 3 — identify the process that wrote the value

The initiating-process fields can connect the registry modification to the suspicious process chain already reconstructed in this case.

let TargetDevice = "WS-FIN-042";
let TargetTime = datetime(2026-08-18 01:25:11);
DeviceRegistryEvents
| where DeviceName =~ TargetDevice
| where Timestamp between (TargetTime - 5m .. TargetTime + 5m)
| where RegistryKey contains @"\CurrentVersion\Run"
| project Timestamp,
          RegistryKey,
          RegistryValueName,
          RegistryValueData,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine,
          InitiatingProcessId,
          InitiatingProcessParentFileName,
          InitiatingProcessAccountName
| order by Timestamp asc

Stage 4 — hunt the value across the estate

Treat the value name and, more importantly, its command data as pivots. First determine whether the same named value appears on other endpoints.

let SuspiciousValueName = "UpdateCheck";
DeviceRegistryEvents
| where Timestamp > ago(7d)
| where RegistryValueName =~ SuspiciousValueName
| summarize FirstSeen=min(Timestamp),
            LastSeen=max(Timestamp),
            Events=count(),
            Devices=dcount(DeviceId),
            DeviceNames=make_set(DeviceName, 50),
            ValueData=make_set(RegistryValueData, 25),
            Creators=make_set(InitiatingProcessFileName, 25)
          by RegistryValueName
| order by FirstSeen asc

Stage 5 — build the registry persistence timeline

Finish by placing the relevant registry events chronologically. This shows where the autorun change sits in relation to execution, network activity and the scheduled task from the previous lesson.

let TargetDevice = "WS-FIN-042";
let StartTime = datetime(2026-08-18 01:22:00);
let EndTime = datetime(2026-08-18 01:30:00);
DeviceRegistryEvents
| where DeviceName =~ TargetDevice
| where Timestamp between (StartTime .. EndTime)
| where RegistryKey contains @"\CurrentVersion\Run"
| project Timestamp,
          ActionType,
          RegistryKey,
          RegistryValueName,
          RegistryValueData,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine,
          InitiatingProcessAccountName
| order by Timestamp asc

Agent Foskett's persistence timeline

Your evidence board

Write the finding like an investigator

Example: Microsoft Defender XDR registry telemetry on WS-FIN-042 recorded an autorun value under a Windows CurrentVersion Run location shortly after the suspicious process, network and scheduled-task activity identified earlier in the investigation. The event preserved the registry value name, stored command, initiating process, account and timestamp. The value data referenced activity associated with the suspicious execution chain, while the initiating-process context connected the registry modification to the same incident sequence. The value name and command were then hunted across the environment to determine whether similar persistence existed on other endpoints. In context, the registry change supports the hypothesis that an additional persistence mechanism was established.

Lesson 147 key takeaways

• DeviceRegistryEvents provides registry activity for Defender XDR advanced hunting.
• Run and RunOnce locations are useful persistence hunting pivots but are also used legitimately.
• Preserve ActionType so creation and modification are not confused.
• RegistryValueData often matters more than the friendly-looking value name.
• Use initiating-process fields to identify what wrote the registry value.
• Account context can help explain the privilege and scope of the change.
• Compare current and previous value data when investigating modifications.
• Hunt distinctive value names, paths and commands across other devices.
• Multiple persistence mechanisms can exist in the same compromise.
• Interpret the registry event as part of the full process, file, network and persistence timeline.

Module 12 — the attack chain continues

Lesson 146 identified scheduled-task persistence. Lesson 147 now uncovers a second autorun mechanism in the registry. Next we investigate whether the attacker moved from persistence into credential access.