Sysmon Event ID 13: Registry value set
Records registry values being written, with the process and the data.
- Log
- Microsoft-Windows-Sysmon/Operational
- Category
- Registry
Why it matters
- The usual way to catch Run key persistence and security settings being switched off through the registry.
What to check
Check TargetObject, Details and Image; focus on Run, RunOnce, services and Defender keys.
How to turn it on
Sysmon configuration including RegistryEvent.
MITRE ATT&CK
- T1547.001 Registry Run Keys / Startup Folder
- T1112 Modify Registry