Sysmon Event ID 12: RegistryEvent (Object create/delete)
Sysmon Event ID 12 records registry key and value create or delete operations.
- Applicable version
- Sysmon with this event enabled
- Last reviewed
- 2026-07-13
Trigger Scenarios
Sysmon emits this event when a configured RegistryEvent rule observes a registry object being created or deleted. Microsoft documents this event as useful for monitoring autostart locations and specific malware registry changes.
Key Fields
EventType
Identifies the registry object operation, such as CreateKey or DeleteKey, so analysts can distinguish new persistence material from cleanup activity.
TargetObject
The registry path uses Sysmon's abbreviated root names such as HKLM, HKU, and HKCR. Paths under HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or HKLM\\System\\CurrentControlSet\\Services are high-value persistence and service-control locations.
Image / ProcessGuid
Identifies the process that created or deleted the registry object and provides a stable join key to Sysmon Event ID 1 for the original command line.
Common False Positives
- Approved administration, management agents, and deployment tools can generate this telemetry.
- Baseline expected hosts, signed binaries, and change windows before suppression.
Related Events
MITRE ATT&CK Mapping
- T1112Modify Registry
Detection Notes
Alert when EventType=CreateKey or EventType=DeleteKey touches HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run, HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run, or HKLM\\System\\CurrentControlSet\\Services from an Image outside the approved software deployment baseline. Sysinternals documents Event 12 for registry object create/delete activity and uses HKLM/HKU/HKCR abbreviations, so these TargetObject values are directly observable. Creation in Run or Services can establish persistence, while deletion can remove forensic or defensive configuration; map this to T1112 Modify Registry and correlate ProcessGuid to Event 1 for the full command line.
Sysmon
| where EventID == 12
| project TimeGenerated, Computer, Image, ProcessGuidindex=sysmon EventCode=12 | table _time, host, Image, ProcessGuidUtcTime: 2026-07-13 01:00:00.000
EventType: CreateKey
TargetObject: HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Updater
Image: C:\\Users\\Public\\updater.exe
ProcessGuid: {REDACTED}