M365 Defender Integration: Rather than removing HKEY_CURRENT_USER and and HKEY_LOCAL_MACHINE, replace them with HKCU and HKLM to avoiding breaking detection rules #10143
Description
In https://github.com/elastic/integrations/blob/main/packages/m365_defender/data_stream/event/elasticsearch/ingest_pipeline/pipeline_device.yml#L533 HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE are stripped from ctx.m365_defender.event.registry.key. As a result, rules like https://github.com/elastic/detection-rules/blob/020ca4be24d4e38d8ac8f3fff6551d588042347e/rules/_deprecated/privilege_escalation_printspooler_malicious_registry_modification.toml#L34, which refer to the abbreviated form of those values, won't be triggered.
Instead of stripping those values, the integration should replace them with their standard abbreviations (HKCU and HKLM), which are used by the rules. Additionally, it should fill the ECS field regisitry.hive as without this there is no way to know what registry hive the key is located in.