Services

Description

Gets the service name from the registry key.

Query · kql

DeviceRegistryEvents  
| where RegistryKey has @"SYSTEM\CurrentControlSet\Services"
| extend ServiceName=tostring(split(RegistryKey, @"\")[4])
| project Timestamp, DeviceName, ServiceName, ActionType, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, InitiatingProcessMD5, InitiatingProcessParentFileName
| top 100 by Timestamp desc
Raw source Services · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: dd76f1c0-edc9-45cb-aeae-f5142caf583c
name: Services
description: |
  Gets the service name from the registry key.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceRegistryEvents
query: |
  DeviceRegistryEvents  
  | where RegistryKey has @"SYSTEM\CurrentControlSet\Services"
  | extend ServiceName=tostring(split(RegistryKey, @"\")[4])
  | project Timestamp, DeviceName, ServiceName, ActionType, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, InitiatingProcessMD5, InitiatingProcessParentFileName
  | top 100 by Timestamp desc

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.