win:sysmon 14
RegistryEvent (Key and Value Rename)
Registry key and value rename operations map to this event type, recording the new name of the key or value that was renamed.
- Log source
- Sysmon
- Host type
- Windows (workstation, member server, domain controller)
- How to enable
- Install Sysmon with a configuration that includes the matching rule group; see sysmon-modular for an ATT&CK-mapped configuration.
- Tier, host type
- Minimum
- Techniques
- 53
- Rules depending on it
- Splunk 2, Sigma 41, Elastic 53
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstation | Minimum | |
| Windows member server | Minimum | |
| Windows domain controller | Minimum | |
| Windows web server (IIS), internet-facing | Minimum |
Techniques it helps detect
- T1003.001 LSASS Memory
- T1003.002 Security Account Manager
- T1012 Query Registry
- T1053.005 Scheduled Task
- T1056.001 Keylogging
- T1070 Indicator Removal
- T1082 System Information Discovery
- T1111 Multi-Factor Authentication Interception
- T1112 Modify Registry
- T1137 Office Application Startup
- T1137.001 Office Template Macros
- T1137.002 Office Test
- T1137.006 Add-ins
- T1176 Software Extensions
- T1176.001 Browser Extensions
- T1195.001 Compromise Software Dependencies and Development Tools
- T1195.002 Compromise Software Supply Chain
- T1218.003 CMSTP
- T1218.009 Regsvcs/Regasm
- T1218.012 Verclsid
- T1218.014 MMC
- T1219 Remote Access Tools
- T1480 Execution Guardrails
- T1490 Inhibit System Recovery
- T1518.002 Backup Software Discovery
- T1543 Create or Modify System Process
- T1543.003 Windows Service
- T1546.001 Change Default File Association
- T1546.002 Screensaver
- T1546.008 Accessibility Features
- T1546.010 AppInit DLLs
- T1547 Boot or Logon Autostart Execution
- T1547.001 Registry Run Keys / Startup Folder
- T1547.003 Time Providers
- T1547.008 LSASS Driver
- T1547.012 Print Processors
- T1547.014 Active Setup
- T1548 Abuse Elevation Control Mechanism
- T1548.002 Bypass User Account Control
- T1552 Unsecured Credentials
- T1552.002 Credentials in Registry
- T1564 Hide Artifacts
- T1564.002 Hidden Users
- T1564.003 Hidden Window
- T1564.005 Hidden File System
- T1569 System Services
- T1569.002 Service Execution
- T1652 Device Driver Discovery
- T1685 Disable or Modify Tools
- T1685.001 Disable or Modify Windows Event Log
- T1686 Disable or Modify System Firewall
- T1686.003 Windows Host Firewall
- T1688 Safe Mode Boot
Rules that depend on it
Sigma 41
- Atbroker Registry Change by Mateusz Wydra, oscd.community
- CMSTP App Paths Registry Key Modification by Nik Seetharaman
- Creation of a Local Hidden User Account by Registry by Christian Burkard (Nextron Systems)
- DLL Load via LSASS by Florian Roth (Nextron Systems)
- Diamond Sleet APT Scheduled Task Creation - Registry by Nasreddine Bencherchali (Nextron Systems)
- Disable Security Events Logging Adding Reg Key MiniNt by Ilyas Ochkov, oscd.community
- Esentutl Volume Shadow Copy Service Keys by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
- FlowCloud Registry Markers by NVISO
- HybridConnectionManager Service Installation - Registry by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
- Leviathan Registry Key Activity by Aidan Bracher
- Narrator's Feedback-Hub Persistence by Dmitriy Lifanov, oscd.community
- NetNTLM Downgrade Attack - Registry by Florian Roth (Nextron Systems), wagga, Nasreddine Bencherchali (Splunk STRT)
- New DLL Added to AppCertDlls Registry Key by Ilyas Ochkov, oscd.community
- New DLL Added to AppInit_DLLs Registry Key by Ilyas Ochkov, oscd.community, Tim Shelton
- New PortProxy Registry Entry Added by Andreas Hunkeler (@Karneades)
- OceanLotus Registry Activity by megan201296, Jonhnathan Ribeiro
- Office Application Startup - Office Test by omkar72
- OilRig APT Registry Persistence by Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community
- Pandemic Registry Key by Florian Roth (Nextron Systems)
- Path To Screensaver Binary Modified by Bartlomiej Czyz @bczyz1, oscd.community
- Potential Credential Dumping Via LSASS SilentProcessExit Technique by Florian Roth (Nextron Systems)
- Potential Qakbot Registry Activity by Hieu Tran
- PrinterNightmare Mimikatz Driver Name by Markus Neis, @markus_neis, Florian Roth
- RedMimicry Winnti Playbook Registry Manipulation by Alexander Rausch
- Registry Entries For Azorult Malware by Trent Liffick
- Registry Persistence Mechanisms in Recycle Bin by frack113
- Registry Tampering by Potentially Suspicious Processes by Swachchhanda Shrawan Poudel (Nextron Systems)
- Run Once Task Configuration in Registry by Avneet Singh @v3t0_, oscd.community
- SNAKE Malware Covert Store Registry Key by Nasreddine Bencherchali (Nextron Systems)
- Scheduled Task Created - Registry by Center for Threat Informed Defense (CTID) Summiting the Pyramid Team
- Security Support Provider (SSP) Added to LSA Configuration by iwillkeepwatch
- Shell Open Registry Keys Manipulation by Christian Burkard (Nextron Systems)
- Sticky Key Like Backdoor Usage - Registry by Florian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community
- Suspicious Camera and Microphone Access by Den Iuzvyk
- Suspicious Run Key from Download by Florian Roth (Nextron Systems), Swachchhanda Shrawan Poude (Nextron Systems)
- UAC Bypass Via Wsreset by oscd.community, Dmitry Uchakin
- WINEKEY Registry Modification by omkar72
- Wdigest CredGuard Registry Modification by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
- Windows Credential Editor Registry by Florian Roth (Nextron Systems)
- Windows Defender Threat Severity Default Action Modified by Matt Anderson (Huntress)
- Windows Registry Trust Record Modification by Antonlovesdnb, Trent Liffick (@tliffick)
Elastic 53
- Code Signing Policy Modification Through Registryinferred
- Creation of a Hidden Local User Accountinferred
- Creation or Modification of Root Certificateinferred
- DNS Global Query Block List Modified or Disabledinferred
- DNS-over-HTTPS Enabled via Registryinferred
- Disabling Lsa Protection via Registry Modificationinferred
- Disabling User Account Control via Registry Modificationinferred
- First Time Seen Removable Deviceinferred
- Full User-Mode Dumps Enabled System-Wideinferred
- Image File Execution Options Injectioninferred
- Installation of Custom Shim Databasesinferred
- Installation of Security Support Providerinferred
- Local Account TokenFilter Policy Disabledinferred
- MS Office Macro Security Registry Modificationsinferred
- Microsoft Windows Defender Tamperinginferred
- Modification of AmsiEnable Registry Keyinferred
- Modification of WDigest Security Providerinferred
- Netsh Helper DLLinferred
- Network Logon Provider Registry Modificationinferred
- Network-Level Authentication (NLA) Disabledinferred
- NullSessionPipe Registry Modificationinferred
- Office Test Registry Persistenceinferred
- Outlook Home Page Registry Modificationinferred
- Persistence via Hidden Run Key Detectedinferred
- Port Forwarding Rule Additioninferred
- Potential ClickFix Command via Windows Run Dialoginferred
- Potential FileFix Command via Windows Explorer Address Barinferred
- Potential NetNTLMv1 Downgrade Attackinferred
- Potential Persistence via Time Provider Modificationinferred
- Potential Privilege Escalation via Service ImagePath Modificationinferred
- Potential REMCOS Trojan Executioninferred
- Potential Remote Desktop Shadowing Activityinferred
- Potential RemoteMonologue Attackinferred
- Potential Uninstall Entry Concealmentinferred
- PowerShell Script Block Logging Disabledinferred
- Privilege Escalation via Windir Environment Variableinferred
- RDP Enabled via Registryinferred
- Registry Persistence via AppCert DLLinferred
- Registry Persistence via AppInit DLLinferred
- Remote Scheduled Task Creationinferred
- SIP Provider Modificationinferred
- Scheduled Task Created by a Windows Scriptinferred
- Scheduled Tasks AT Command Enabledinferred
- Service Path Modificationinferred
- SolarWinds Process Disabling Services via Registryinferred
- Suspicious ImagePath Service Creationinferred
- Suspicious Print Spooler Point and Print DLLinferred
- Suspicious Startup Shell Folder Modificationinferred
- Uncommon Registry Persistence Changeinferred
- Unusual Persistence via Services Registryinferred
- Werfault ReflectDebugger Persistenceinferred
- Windows Defender Disabled via Registry Modificationinferred
- Windows Subsystem for Linux Distribution Installedinferred
EDR events that stand in for it
Full: the sensor event carries what this event carries. Partial: the sensor reports a subset, so it does not replace the event.
| Product | Sensor event | Fidelity | Basis |
|---|---|---|---|
| Microsoft Defender for Endpoint device tables | DeviceRegistryEvents | Full | pySigma-backend-kusto: Sysmon EventID 14 (rename) -> DeviceRegistryEvents |