Skip to content

Instantly share code, notes, and snippets.

@Castaldio86

Castaldio86/DefendDefenderATP

Created March 3, 2020 22:29
Show Gist options
  • Save Castaldio86/c52b7601917ba16b26516870a75622e3 to your computer and use it in GitHub Desktop.
Save Castaldio86/c52b7601917ba16b26516870a75622e3 to your computer and use it in GitHub Desktop.
Download ZIP
DefendDefenderATP
Raw
DefendDefenderATP
DeviceRegistryEvents
| where * contains "\\SOFTWARE\\Policies\\Microsoft\\Windows Advanced Threat Protection" and
ActionType == "RegistryKeyDeleted" or
RegistryValueName == "OnboardingInfo" and RegistryValueData != PreviousRegistryValueData
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment