✄𐘗
text code block:
✄𐘗from logs-endpoint.events.registry-*, logs-windows.sysmon_operational-*, winlogbeat-*,
  logs-windows.forwarded-*, logs-m365_defender.event-*, logs-sentinel_one_cloud_funnel.*,
  logs-crowdstrike.fdr* metadata _id, _version, _index
| where KQL(""" host.os.type : "windows" AND event.category:"registry" AND event.type : ("creation" or "change") """)
  and registry.data.strings is not null
  and (
    to_lower(registry.path) like """hkey_users\\*\\software\\microsoft\\windows\\currentversion\\explorer\\typedpaths\\*"""
    or to_lower(registry.path) like """\\registry\\user\\*\\software\\microsoft\\windows\\currentversion\\explorer\\typedpaths\\*"""
    or to_lower(registry.path) like """hku\\*\\software\\microsoft\\windows\\currentversion\\explorer\\typedpaths\\*"""
    or to_lower(registry.path) like """hkcu\\software\\microsoft\\windows\\currentversion\\explorer\\typedpaths\\*"""
    or to_lower(registry.path) like """hkey_current_user\\software\\microsoft\\windows\\currentversion\\explorer\\typedpaths\\*"""
  )
| eval registry_data = to_lower(mv_concat(registry.data.strings, " "))
| where
  // Command form only. A bare path to the binary, such as ...\\powershell.exe, does not match.
  // PowerShell / PowerShell 7
  registry_data like "*powershell *" or
  registry_data like "*powershell.exe *" or
  registry_data like "*powershell.exe\" *" or
  registry_data like "*pwsh *" or
  registry_data like "*pwsh.exe *" or
  registry_data like "*pwsh.exe\" *" or
  // Mshta
  registry_data like "*mshta *" or
  registry_data like "*mshta.exe *" or
  registry_data like "*mshta.exe\" *" or
  // Msiexec, including a quiet local package such as msiexec /i "\\users\\...\\file.msi" /qb
  registry_data like "*msiexec *" or
  registry_data like "*msiexec.exe *" or
  registry_data like "*msiexec.exe\" *" or
  // Rundll32
  registry_data like "*rundll32 *" or
  registry_data like "*rundll32.exe *" or
  registry_data like "*rundll32.exe\" *" or
  // Cmd. Require /c, /k, cmd.exe, or comspec so a folder name containing "cmd" does not match.
  registry_data like "*cmd.exe *" or
  registry_data like "*cmd.exe\" *" or
  registry_data like "*cmd /c *" or
  registry_data like "*cmd /k *" or
  registry_data like "*cmd.exe /c *" or
  registry_data like "*cmd* /d /c for /r*" or 
  registry_data like "*cmd* in (f_*" or 
  registry_data like "*%comspec%*" or
  // Other living-off-the-land binaries used in FileFix and ClickFix paste chains
  registry_data like "*curl *" or
  registry_data like "*curl.exe *" or
  registry_data like "*curl.exe\" *" or
  registry_data like "*wget *" or
  registry_data like "*wget.exe *" or
  registry_data like "*wget.exe\" *" or
  registry_data like "*certutil *" or
  registry_data like "*certutil.exe *" or
  registry_data like "*certutil.exe\" *" or
  registry_data like "*certreq *" or
  registry_data like "*certreq.exe *" or
  registry_data like "*certreq.exe\" *" or
  registry_data like "*bitsadmin *" or
  registry_data like "*bitsadmin.exe *" or
  registry_data like "*bitsadmin.exe\" *" or
  registry_data like "*wscript *" or
  registry_data like "*wscript.exe *" or
  registry_data like "*wscript.exe\" *" or
  registry_data like "*cscript *" or
  registry_data like "*cscript.exe *" or
  registry_data like "*cscript.exe\" *" or
  registry_data like "*conhost *" or
  registry_data like "*conhost.exe *" or
  registry_data like "*conhost.exe\" *" or
  registry_data like "*forfiles *" or
  registry_data like "*forfiles.exe *" or
  registry_data like "*forfiles.exe\" *"
| keep _id, _version, _index, data_stream.namespace, @timestamp, event.dataset, user.id, user.name, user.domain, host.id, host.name, agent.id, process.name, process.entity_id, process.executable, process.pid, registry.data.strings, registry.path, registry.value