Event ID 4657: A registry value was modified
Written when a registry value is changed on a key that has auditing (a SACL) configured.
- Log
- Security
- Category
- Object access
Why it matters
- Only works for keys you have chosen to audit, such as Run keys and security settings.
What to check
Check the Object Name (key), value, old and new data, and Process Name.
How to turn it on
Advanced Audit Policy: Object Access > Audit Registry, plus a SACL on the keys to watch.
MITRE ATT&CK
- T1112 Modify Registry
- T1547.001 Registry Run Keys / Startup Folder