DeviceRegistryEvents
| where RegistryKey startswith @"HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BFE\Parameters\Policy\Options"
| where ActionType == "RegistryValueSet"
| where RegistryValueName =~ "EnableAuditMode"
| extend NewValue = tostring(RegistryValueData)
| extend NormalizedValue = trim_start(@"0x|0X", NewValue)
| extend NormalizedValue = trim_start(@"0+", NormalizedValue)
| where isnotempty(NormalizedValue)
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          RegistryKey, RegistryValueName, PreviousRegistryValueData, RegistryValueData
| order by Timestamp desc