Sysmon Event ID 13: Registry Value Set — Run Keys, Details, KQL
Published
A process wrote a registry value — Sysmon records the full value path, the data written for numeric values, and the process and account that wrote it.
Logged to: Microsoft-Windows-Sysmon/Operational, on the machine where it happened; filtered in a Sysmon configuration by the <RegistryEvent> element.
Microsoft's description
Event ID 13: RegistryEvent (Value Set)
This Registry event type identifies Registry value modifications. The event records the value written for Registry values of type DWORD and QWORD.
Source: Microsoft's Sysmon documentation
Every field of event 13
| Field | What it tells you |
|---|---|
| TargetObject | The full path of the registry value, with Sysmon's abbreviated root key names (HKLM, HKU, HKCR). Run keys, services and security settings are the paths to watch. |
| Details | The data written. Microsoft documents that the event records the value for DWORD and QWORD values; for a string value such as a Run entry, read it as the program or command that will start. |
| Image | The process that wrote the value. reg.exe, powershell.exe or a binary in a temp folder writing autostart keys is the usual finding. |
| EventType | SetValue for this event; events 12 and 14 use the same RegistryEvent rules for keys created, deleted and renamed. |
| User | The account the writing process runs as. Writes under HKU\<SID> belong to one user's profile; HKLM writes need administrative rights. |
| ProcessGuid | Joins the change to the writer's process creation (event 1) for its command line and parent. |
| RuleName | — |
| UtcTime | — |
| ProcessId | — |
Field names and order from Sysmon's manifest (schema 4.90), checked on every build.
What it records
Microsoft’s description: “This Registry event type identifies Registry value modifications. The event records the value written for Registry values of type DWORD and QWORD.” The fields are EventType (SetValue), TargetObject (the value’s full path), Details (the data written), and the writer — Image, ProcessGuid, ProcessId and User — with UtcTime and RuleName.
Paths use Sysmon’s abbreviated root key names. Microsoft’s table maps HKEY_LOCAL_MACHINE to HKLM, HKEY_USERS to HKU, HKEY_LOCAL_MACHINE\System\ControlSet00x to HKLM\System\CurrentControlSet, and HKEY_LOCAL_MACHINE\Classes to HKCR. Per-user settings therefore appear under HKU\S-1-5-21-…\, the hive of the account with that SID.
Events 12, 13 and 14 share one configuration element, <RegistryEvent>, so a rule names the paths once:
<RegistryEvent onmatch="include">
<TargetObject condition="contains">\CurrentVersion\Run</TargetObject>
<TargetObject condition="contains">\Services\</TargetObject>
</RegistryEvent>When it matters
| TargetObject contains | Reading |
|---|---|
\Software\Microsoft\Windows\CurrentVersion\Run or \RunOnce | A program set to start at logon (T1547.001); Details is what will run |
\System\CurrentControlSet\Services\<name>\ImagePath | A service created or repointed — compare with Windows event 4697 |
\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell or \Userinit | Persistence through the logon process |
\Image File Execution Options\<program>\Debugger | A program that starts whenever another one is run |
\Microsoft\Windows Defender\ with DWORD values set to 1 (for example DisableAntiSpyware or DisableRealtimeMonitoring) | Antivirus being switched off (T1562.001) |
| Any of these written by reg.exe, powershell.exe, mshta.exe or a binary in a temp folder | The change came from a script or dropped tool, not an installer |
How to investigate
Autostart values written in the last week, with the command they will run:
Event
| where TimeGenerated > ago(7d)
| where Source == "Microsoft-Windows-Sysmon" and EventID == 13
| extend D = parse_xml(EventData).DataItem.EventData.Data
| mv-apply d = D on (summarize f = make_bag(bag_pack(tostring(d["@Name"]), tostring(d["#text"]))))
| extend TargetObject = tostring(f.TargetObject), Details = tostring(f.Details), Image = tostring(f.Image), Account = tostring(f.User)
| where TargetObject has_any (@"\CurrentVersion\Run", @"\Winlogon\Shell", @"\Winlogon\Userinit", @"\Image File Execution Options\")
| project TimeGenerated, Computer, Account, Image, TargetObject, DetailsDefender settings changed through the registry:
Event
| where TimeGenerated > ago(30d)
| where Source == "Microsoft-Windows-Sysmon" and EventID == 13
| extend D = parse_xml(EventData).DataItem.EventData.Data
| mv-apply d = D on (summarize f = make_bag(bag_pack(tostring(d["@Name"]), tostring(d["#text"]))))
| extend TargetObject = tostring(f.TargetObject), Details = tostring(f.Details), Image = tostring(f.Image)
| where TargetObject has @"\Microsoft\Windows Defender\" and Details == "DWORD (0x00000001)"
| project TimeGenerated, Computer, Image, TargetObject, DetailsFor each change, follow ProcessGuid to the writer’s process creation event to see what ran it and from where, and check whether the program in Details exists and has run. Service changes have a Windows-side record too: Security event 4697 when a service is installed, if your Security log audits it, and System event 7045.
Read a Sysmon log without a SIEM
Copy Microsoft-Windows-Sysmon%4Operational.evtx from C:\Windows\System32\winevt\Logs (or wevtutil epl Microsoft-Windows-Sysmon/Operational sysmon.evtx) and open it in the EVTX viewer: every event in a table, event 13 filterable, with the analyzer's checks for LSASS access, remote threads and suspicious command lines. Nothing is uploaded.
Related events
- Sysmon Event ID 1 Process creation
- Sysmon Event ID 12 RegistryEvent (Object create and delete)
- Sysmon Event ID 14 RegistryEvent (Key and Value Rename)
- Security Event ID 4688 A new process has been created
- Security Event ID 4697 A service was installed in the system
Detect it
Frequently Asked Questions
- What does HKU mean in a Sysmon registry event?
- Sysmon abbreviates registry root key names. Microsoft's documentation lists the mappings HKEY_LOCAL_MACHINE to HKLM, HKEY_USERS to HKU, HKEY_LOCAL_MACHINE\System\ControlSet00x to HKLM\System\CurrentControlSet and HKEY_LOCAL_MACHINE\Classes to HKCR. A path under HKU\<SID> is the per-user hive of the account with that SID.
- What is in the Details field of Sysmon Event ID 13?
- The data written to the value. Microsoft's description says the event records the value written for registry values of type DWORD and QWORD, which appear as DWORD (0x…) or QWORD (…), and string values appear as the text written, such as the command line a Run key will start.
- Which registry keys should I watch for persistence?
- Start with the Run and RunOnce keys under HKLM and each user's HKU hive (…\Software\Microsoft\Windows\CurrentVersion\Run), services under HKLM\System\CurrentControlSet\Services, Winlogon values such as Shell and Userinit, and Image File Execution Options. A configuration that includes these paths in its <RegistryEvent> rules catches most autostart persistence.
- Why is the same change logged as several events?
- Creating a key and then setting a value in it produces event 12 for the key and event 13 for the value, and renaming produces event 14. All three share the RegistryEvent configuration element, so a rule for a path catches all of them.
Find every Sysmon 13 that matters
Open a Sysmon .evtx or XML export in the free browser analyzer: LSASS access, remote thread injection, process tampering, suspicious command lines and reverse-shell ports are flagged, with the events behind each. Nothing is uploaded.
Investigating something right now? LogTriage checks every address in the file against threat intelligence and writes the incident report: 10 analyses a month free. The incident pack adds the in-depth AI analysis and files up to 100 MB: 25 analyses for $19, one payment, no subscription. Pricing
Every query on this site's reference pages, the Sigma rules and a cheat sheet in one download: the Incident Response Kit, $29 once.