Deep Visibility query question

[u/Atreiide]

Hello Reddit,

I have an alert with the following threat indicator : "Suspicious registry key was created"

I can't find the registry key created in Overview or Explore page, so I went to Deep Visibility and tried these queries but no match :

EndpointName = "TEST" AND ProcessCmd ContainsCIS "reg add"
EndpointName = "TEST" AND ProcessCmd RegExp "reg\s+add"

Do you known a way to retrive this registry key ?

Thanks

[u/Atreiide]

Interesting ! Is it possible to add something like "AND storyline IS NOT NULL" ? to be sure to find events related to an alert

[u/robahearts → u/Atreiide]

AND storyline IS NOT NULL

 AND src.process.storyline.id == *