Forum Discussion
eladfe
Nov 04, 2025Copper Contributor
Kql query that search reg key
Hay
I created the next kql query but unfraternally i get O devices on the results :
// Search for creation, modification, or deletion events for the specified ESU registry key
DeviceRegistryEvents
| where RegistryKey has_any (@"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\ESU", @"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\ESU")
| project Timestamp, DeviceName, ActionType, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc
Am I doing something wrong?
Thanks
Elad.
No RepliesBe the first to reply