Component Object Model Hijacking - Vault7 trick

DeviceRegistryEvents
| where RegistryKey contains "ShellFolder"  and ActionType == "RegistryValueSet" and RegistryValueName =~ "Attributes" 
//toint automatically converts base10 and base16 strings to int toint("0xFF") == toint("255") == int(0xFF) ==  int(255)
//here we need to use long type as int in KQL is a 32-bit signed integer
// We're using >= to make sure that if someone adds an additional flag to this field, it doesn't bypass this hunt.
// removing any flag will bypass this hunt, but more research is needed to understand which of the flag values are relevant
| where tolong(RegistryValueData) >= long(0xf090013d)