Chromeloader Registry Value Large Size Generic
Query
DeviceRegistryEvents | where RegistryValueType =~ 'String' | where RegistryValueName != @"OnboardingInfo"
| where strlen(RegistryValueData) > 5000
| where InitiatingProcessFileName != @"mssense.exe"Explanation
Show me all Device Registry Events where the Registry Value Type is a String, the Registry Value Name is not "OnboardingInfo", the length of the Registry Value Data is greater than 5000 characters, and the Initiating Process File Name is not "mssense.exe".