win:sysmon 12
RegistryEvent (Object create and delete)
Registry key and value create and delete operations map to this event type, which can be useful for monitoring for changes to Registry autostart locations, or specific malware registry modifications.
- Log source
- Sysmon
- Host type
- Windows (workstation, member server, domain controller)
- How to enable
- Install Sysmon with a configuration that includes the matching rule group; see sysmon-modular for an ATT&CK-mapped configuration.
- Tier, host type
- Minimum
- Techniques
- 11
- Rules depending on it
- Splunk 15, Sigma 54, Elastic 53, Microsoft Sentinel 1
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstation | Minimum | |
| Windows member server | Minimum | |
| Windows domain controller | Minimum | |
| Windows web server (IIS), internet-facing | Minimum |
Techniques it helps detect
Rules that depend on it
Splunk 15
- Add DefaultUser And Password In Registry
- Malicious InProcServer32 Modification
- Remcos client registry install entry
- Revil Registry Entry
- Sdclt UAC Bypass
- WSReset UAC Bypass
- Windows CrowdStrike Agent Registry Key Removal
- Windows Deleted Registry By A Non Critical Process File Path
- Windows Downdate Registry Activity
- Windows Modify Registry Delete Firewall Rules
- Windows RDP Server Registry Deletion
- Windows Registry Delete Task SD
- Windows RunMRU Registry Key or Value Deleted
- Windows USBSTOR Registry Key Modification
- Windows WPDBusEnum Registry Key Modification
Sigma 54
- Atbroker Registry Change by Mateusz Wydra, oscd.community
- CMSTP App Paths Registry Key Modification by Nik Seetharaman
- Creation of a Local Hidden User Account by Registry by Christian Burkard (Nextron Systems)
- DLL Load via LSASS by Florian Roth (Nextron Systems)
- Delete Defender Scan ShellEx Context Menu Registry Key by Matt Anderson (Huntress)
- Diamond Sleet APT Scheduled Task Creation - Registry by Nasreddine Bencherchali (Nextron Systems)
- Disable Security Events Logging Adding Reg Key MiniNt by Ilyas Ochkov, oscd.community
- Esentutl Volume Shadow Copy Service Keys by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
- FlowCloud Registry Markers by NVISO
- Folder Removed From Exploit Guard ProtectedFolders List - Registry by Nasreddine Bencherchali (Nextron Systems)
- HybridConnectionManager Service Installation - Registry by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
- Leviathan Registry Key Activity by Aidan Bracher
- Narrator's Feedback-Hub Persistence by Dmitriy Lifanov, oscd.community
- NetNTLM Downgrade Attack - Registry by Florian Roth (Nextron Systems), wagga, Nasreddine Bencherchali (Splunk STRT)
- New DLL Added to AppCertDlls Registry Key by Ilyas Ochkov, oscd.community
- New DLL Added to AppInit_DLLs Registry Key by Ilyas Ochkov, oscd.community, Tim Shelton
- New PortProxy Registry Entry Added by Andreas Hunkeler (@Karneades)
- OceanLotus Registry Activity by megan201296, Jonhnathan Ribeiro
- Office Application Startup - Office Test by omkar72
- OilRig APT Registry Persistence by Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community
- Pandemic Registry Key by Florian Roth (Nextron Systems)
- Path To Screensaver Binary Modified by Bartlomiej Czyz @bczyz1, oscd.community
- Potential Credential Dumping Via LSASS SilentProcessExit Technique by Florian Roth (Nextron Systems)
- Potential NetWire RAT Activity - Registry by Christopher Peacock
- Potential Persistence Via Disk Cleanup Handler - Registry by Nasreddine Bencherchali (Nextron Systems)
- Potential Qakbot Registry Activity by Hieu Tran
- Potential Ursnif Malware Activity - Registry by megan201296
- PrinterNightmare Mimikatz Driver Name by Markus Neis, @markus_neis, Florian Roth
- RedMimicry Winnti Playbook Registry Manipulation by Alexander Rausch
- Registry Entries For Azorult Malware by Trent Liffick
- Registry Persistence Mechanisms in Recycle Bin by frack113
- Registry Tampering by Potentially Suspicious Processes by Swachchhanda Shrawan Poudel (Nextron Systems)
- Removal Of AMSI Provider Registry Keys by frack113
- Removal Of Index Value to Hide Schedule Task - Registry by Nasreddine Bencherchali (Nextron Systems)
- Removal Of SD Value to Hide Schedule Task - Registry by Sittikorn S
- Removal of Potential COM Hijacking Registry Keys by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
- Run Once Task Configuration in Registry by Avneet Singh @v3t0_, oscd.community
- RunMRU Registry Key Deletion - Registry by Swachchhanda Shrawan Poudel (Nextron Systems)
- SNAKE Malware Covert Store Registry Key by Nasreddine Bencherchali (Nextron Systems)
- Scheduled Task Created - Registry by Center for Threat Informed Defense (CTID) Summiting the Pyramid Team
- Security Support Provider (SSP) Added to LSA Configuration by iwillkeepwatch
- Shell Open Registry Keys Manipulation by Christian Burkard (Nextron Systems)
- Sticky Key Like Backdoor Usage - Registry by Florian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community
- Suspicious Camera and Microphone Access by Den Iuzvyk
- Suspicious Run Key from Download by Florian Roth (Nextron Systems), Swachchhanda Shrawan Poude (Nextron Systems)
- Terminal Server Client Connection History Cleared - Registry by Christian Burkard (Nextron Systems)
- UAC Bypass Via Wsreset by oscd.community, Dmitry Uchakin
- WINEKEY Registry Modification by omkar72
- Wdigest CredGuard Registry Modification by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
- Windows Credential Editor Registry by Florian Roth (Nextron Systems)
- Windows Credential Guard Related Registry Value Deleted - Registry by Swachchhanda Shrawan Poudel (Nextron Systems)
- Windows Defender Threat Severity Default Action Modified by Matt Anderson (Huntress)
- Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted by Sajid Nawaz Khan
- Windows Registry Trust Record Modification by Antonlovesdnb, Trent Liffick (@tliffick)
Elastic 53
- Code Signing Policy Modification Through Registryinferred
- Creation of a Hidden Local User Accountinferred
- Creation or Modification of Root Certificateinferred
- DNS Global Query Block List Modified or Disabledinferred
- DNS-over-HTTPS Enabled via Registryinferred
- Disabling Lsa Protection via Registry Modificationinferred
- Disabling User Account Control via Registry Modificationinferred
- First Time Seen Removable Deviceinferred
- Full User-Mode Dumps Enabled System-Wideinferred
- Image File Execution Options Injectioninferred
- Installation of Custom Shim Databasesinferred
- Installation of Security Support Providerinferred
- Local Account TokenFilter Policy Disabledinferred
- MS Office Macro Security Registry Modificationsinferred
- Microsoft Windows Defender Tamperinginferred
- Modification of AmsiEnable Registry Keyinferred
- Modification of WDigest Security Providerinferred
- Netsh Helper DLLinferred
- Network Logon Provider Registry Modificationinferred
- Network-Level Authentication (NLA) Disabledinferred
- NullSessionPipe Registry Modificationinferred
- Office Test Registry Persistenceinferred
- Outlook Home Page Registry Modificationinferred
- Persistence via Hidden Run Key Detectedinferred
- Port Forwarding Rule Additioninferred
- Potential ClickFix Command via Windows Run Dialoginferred
- Potential FileFix Command via Windows Explorer Address Barinferred
- Potential NetNTLMv1 Downgrade Attackinferred
- Potential Persistence via Time Provider Modificationinferred
- Potential Privilege Escalation via Service ImagePath Modificationinferred
- Potential REMCOS Trojan Executioninferred
- Potential Remote Desktop Shadowing Activityinferred
- Potential RemoteMonologue Attackinferred
- Potential Uninstall Entry Concealmentinferred
- PowerShell Script Block Logging Disabledinferred
- Privilege Escalation via Windir Environment Variableinferred
- RDP Enabled via Registryinferred
- Registry Persistence via AppCert DLLinferred
- Registry Persistence via AppInit DLLinferred
- Remote Scheduled Task Creationinferred
- SIP Provider Modificationinferred
- Scheduled Task Created by a Windows Scriptinferred
- Scheduled Tasks AT Command Enabledinferred
- Service Path Modificationinferred
- SolarWinds Process Disabling Services via Registryinferred
- Suspicious ImagePath Service Creationinferred
- Suspicious Print Spooler Point and Print DLLinferred
- Suspicious Startup Shell Folder Modificationinferred
- Uncommon Registry Persistence Changeinferred
- Unusual Persistence via Services Registryinferred
- Werfault ReflectDebugger Persistenceinferred
- Windows Defender Disabled via Registry Modificationinferred
- Windows Subsystem for Linux Distribution Installedinferred
Microsoft Sentinel 1
EDR events that stand in for it
Full: the sensor event carries what this event carries. Partial: the sensor reports a subset, so it does not replace the event.
| Product | Sensor event | Fidelity | Basis |
|---|---|---|---|
| CrowdStrike Falcon sensor telemetry (FDR event_simpleName) | RegKeyCreated | Full | pySigma-backend-crowdstrike: registry_event -> RegKeyCreated, RegKeyDeleted, RegValueDeleted |
| CrowdStrike Falcon sensor telemetry (FDR event_simpleName) | RegKeyDeleted | Full | pySigma-backend-crowdstrike: registry_event -> RegKeyCreated, RegKeyDeleted, RegValueDeleted |
| CrowdStrike Falcon sensor telemetry (FDR event_simpleName) | RegValueDeleted | Full | pySigma-backend-crowdstrike: registry_event -> RegKeyCreated, RegKeyDeleted, RegValueDeleted |
| Microsoft Defender for Endpoint device tables | DeviceRegistryEvents | Full | pySigma-backend-kusto: Sysmon EventID 12 (create/delete) -> DeviceRegistryEvents (ActionType RegistryKeyCreated, RegistryKeyDeleted, RegistryValueDeleted) |
| Elastic Defend endpoint events | registry | Full | Elastic Defend registry dataset |