SOC Event Lookup
Event ID 12RegistryP2

Sysmon Event ID 12: RegistryEvent (Object create/delete)

Sysmon Event ID 12 records registry key and value create or delete operations.

Applicable version
Sysmon with this event enabled
Last reviewed
2026-07-13

Trigger Scenarios

Sysmon emits this event when a configured RegistryEvent rule observes a registry object being created or deleted. Microsoft documents this event as useful for monitoring autostart locations and specific malware registry changes.

Key Fields

EventType

Identifies the registry object operation, such as CreateKey or DeleteKey, so analysts can distinguish new persistence material from cleanup activity.

TargetObject

The registry path uses Sysmon's abbreviated root names such as HKLM, HKU, and HKCR. Paths under HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or HKLM\\System\\CurrentControlSet\\Services are high-value persistence and service-control locations.

Image / ProcessGuid

Identifies the process that created or deleted the registry object and provides a stable join key to Sysmon Event ID 1 for the original command line.

Common False Positives

  • Approved administration, management agents, and deployment tools can generate this telemetry.
  • Baseline expected hosts, signed binaries, and change windows before suppression.

Related Events

MITRE ATT&CK Mapping

  • T1112Modify Registry

Detection Notes

Alert when EventType=CreateKey or EventType=DeleteKey touches HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run, HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run, or HKLM\\System\\CurrentControlSet\\Services from an Image outside the approved software deployment baseline. Sysinternals documents Event 12 for registry object create/delete activity and uses HKLM/HKU/HKCR abbreviations, so these TargetObject values are directly observable. Creation in Run or Services can establish persistence, while deletion can remove forensic or defensive configuration; map this to T1112 Modify Registry and correlate ProcessGuid to Event 1 for the full command line.

Microsoft Sentinel KQL
Sysmon
| where EventID == 12
| project TimeGenerated, Computer, Image, ProcessGuid
Splunk SPL
index=sysmon EventCode=12 | table _time, host, Image, ProcessGuid
Sample Log
UtcTime: 2026-07-13 01:00:00.000
EventType: CreateKey
TargetObject: HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Updater
Image: C:\\Users\\Public\\updater.exe
ProcessGuid: {REDACTED}

Source