Sysmon Event ID 12
12: RegistryEvent (Object create and delete)
This is an event from
Sysmon.
On this page
Registry key and value create and delete operations map to this event type, which can be useful for monitoring for changes to Registry autostart locations, or specific malware registry modifications.
Sysmon uses abbreviated versions of Registry root key names, with the following mappings:
HKEY_LOCAL_MACHINE --> HKLM
HKEY_USERS --> HKU
HKEY_LOCAL_MACHINE\System\ControlSet00x --> HKLM\System\CurrentControlSet
HKEY_LOCAL_MACHINE\Classes --> HKCR
Free Security Log Resources by Randy
- Log Name
- Source
- Date
- Event ID
- Task Category
- Level
- Keywords
- User
- Computer
- Description
- EventType
- UtcTime
- ProcessGuid
- ProcessId
- Image
- TargetObject
Supercharger Enterprise
Registry object added or deleted:
EventType: DeleteValue
UtcTime: 2017-05-11 04:31:15.792
ProcessGuid: {a23eae89-e8bf-5913-0000-0010db9f7109}
ProcessId: 25228
Image: C:\Windows\regedit.exe
TargetObject: \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\New Value #1
Event XML:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Sysmon" Guid="{5770385F-C22A-43E0-BF4C-06F5698FFBD9}" />
<EventID>12</EventID>
<Version>2</Version>
<Level>4</Level>
<Task>12</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2017-05-11T04:31:15.792607700Z" />
<EventRecordID>725972</EventRecordID>
<Correlation />
<Execution ProcessID="3188" ThreadID="3836" />
<Channel>Microsoft-Windows-Sysmon/Operational</Channel>
<Computer>rfsH.lab.local</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="EventType">DeleteValue</Data>
<Data Name="UtcTime">2017-05-11 04:31:15.792</Data>
<Data Name="ProcessGuid">{A23EAE89-E8BF-5913-0000-0010DB9F7109}</Data>
<Data Name="ProcessId">25228</Data>
<Data Name="Image">C:\Windows\regedit.exe</Data>
<Data Name="TargetObject">\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\New Value #1</Data>
</EventData>
</Event>
Top 10 Windows Security Events to Monitor
Free Tool for Windows Event Collection