Forum Discussion

eladfe's avatar
eladfe
Copper Contributor
Nov 04, 2025

Kql query that search reg key

Hay 

I created the next kql query but unfraternally i get O devices on the results : 

// Search for creation, modification, or deletion events for the specified ESU registry key
DeviceRegistryEvents
| where RegistryKey has_any (@"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\ESU", @"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\ESU")
| project Timestamp, DeviceName, ActionType, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc

 

Am I doing something wrong? 

 

Thanks

Elad.

No RepliesBe the first to reply

Resources