Merge pull request #2614 from Azure/ifeo-fix

Fix CommandLine Issue
Azure · Jul 1, 2021 · 677ecd5 · 677ecd5
2 parents b35ea49 + d48386b
commit 677ecd5
Showing 1 changed file with 2 additions and 3 deletions.
diff --git a/Hunting Queries/MultipleDataSources/PersistViaIFEORegistryKey.yaml b/Hunting Queries/MultipleDataSources/PersistViaIFEORegistryKey.yaml
@@ -23,9 +23,8 @@ query: |
   (
   SecurityEvent
   | where EventID == 4657
-  | where CommandLine has "Image File Execution Options"
-  | where CommandLine has_any ("reg add", "reg delete")
-  | summarize Count=count() by Computer, CommandLine, Account, NewValue, OldValue
+  | where ObjectName has_all ("\\REGISTRY\\MACHINE", "Image File Execution Options")
+  | summarize Count=count() by Computer, Account, ObjectName
   | top 10 by Count desc 
   | extend AccountCustomEntity = Account, HostCustomEntity = Computer
   ),