Whisper Security - Domain Registrar Change Anomaly

// MITRE ATT&CK: T1584 - Compromise Infrastructure
// Tactic: Resource Development
// Detects registrar changes across WHOIS history snapshots
let lookbackPeriod = 14d;
WhisperHistory_CL
| where TimeGenerated > ago(lookbackPeriod)
| where indicatorType == "domain"
| where isnotempty(registrar)
| summarize Registrars = make_set(registrar), SnapshotCount = count(), EarliestSnapshot = min(snapshotDate), LatestSnapshot = max(snapshotDate) by indicator
| where array_length(Registrars) > 1
| mv-expand CurrentRegistrar = Registrars
| extend CurrentRegistrar = tostring(CurrentRegistrar)
| join kind=inner (
        WhisperHistory_CL
| where TimeGenerated > ago(lookbackPeriod)
| where indicatorType == "domain"
| where isnotempty(registrar)
| serialize
| extend PreviousRegistrar = prev(registrar), PreviousIndicator = prev(indicator)
| where indicator == PreviousIndicator
| where registrar != PreviousRegistrar
| where isnotempty(PreviousRegistrar)
| project indicator, OldRegistrar = PreviousRegistrar, NewRegistrar = registrar, ChangeDate = snapshotDate
    ) on indicator
| project TimeGenerated = ChangeDate, DnsDomain = indicator, OldRegistrar, NewRegistrar, ChangeDate, SnapshotCount
| distinct TimeGenerated, DnsDomain, OldRegistrar, NewRegistrar, ChangeDate, SnapshotCount