Change PKSLUI Tampering
Query
DeviceProcessEvents
| where InitiatingProcessParentFileName =~ "slui.exe"
| where InitiatingProcessFileName =~ "changepk.exe"
| where ProcessIntegrityLevel == "High"About this query
Query:
Explanation
This query is looking for device process events where the parent file name is "slui.exe", the file name is "changepk.exe", and the process integrity level is "High".