Whisper Security - Domain Registrar Change Anomaly

Original query, unchanged.

// MITRE ATT&CK: T1584 - Compromise Infrastructure
// Tactic: Resource Development
// Detects registrar changes across WHOIS history snapshots
let lookbackPeriod = 14d;
WhisperHistory_CL
    | where TimeGenerated > ago(lookbackPeriod)
    | where indicatorType == "domain"
    | where isnotempty(registrar)
    | summarize Registrars = make_set(registrar), SnapshotCount = count(), EarliestSnapshot = min(snapshotDate), LatestSnapshot = max(snapshotDate) by indicator
    | where array_length(Registrars) > 1
    | mv-expand CurrentRegistrar = Registrars
    | extend CurrentRegistrar = tostring(CurrentRegistrar)
    | join kind=inner (
        WhisperHistory_CL
        | where TimeGenerated > ago(lookbackPeriod)
        | where indicatorType == "domain"
        | where isnotempty(registrar)
        | serialize
        | extend PreviousRegistrar = prev(registrar), PreviousIndicator = prev(indicator)
        | where indicator == PreviousIndicator
        | where registrar != PreviousRegistrar
        | where isnotempty(PreviousRegistrar)
        | project indicator, OldRegistrar = PreviousRegistrar, NewRegistrar = registrar, ChangeDate = snapshotDate
    ) on indicator
    | project TimeGenerated = ChangeDate, DnsDomain = indicator, OldRegistrar, NewRegistrar, ChangeDate, SnapshotCount
    | distinct TimeGenerated, DnsDomain, OldRegistrar, NewRegistrar, ChangeDate, SnapshotCount