Sysmon Event ID 12: RegistryEvent (Object create/delete)
- Applicable version
- Sysmon with this event enabled
- Last reviewed
- 2026-07-21
Quick summary
Sysmon Event ID 12 records registry key and value create or delete operations.
Technical Metadata
| Event ID | 12 |
|---|---|
| Provider | Microsoft-Windows-Sysmon |
| Channel | Microsoft-Windows-Sysmon/Operational |
| Level | Informational |
| MITRE ATT&CK | TA0005 Defense Evasion / T1112 Modify Registry |
| Key fields to watch | EventType, TargetObject, Image / ProcessGuid |
Trigger Scenarios
Sysmon emits this event when a configured RegistryEvent rule observes a registry object being created or deleted. Microsoft documents this event as useful for monitoring autostart locations and specific malware registry changes.
Key Fields
EventType
Identifies the registry object operation, such as CreateKey or DeleteKey, so analysts can distinguish new persistence material from cleanup activity.
TargetObject
The registry path uses Sysmon's abbreviated root names such as HKLM, HKU, and HKCR. Paths under HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or HKLM\\System\\CurrentControlSet\\Services are high-value persistence and service-control locations.
Image / ProcessGuid
Identifies the process that created or deleted the registry object and provides a stable join key to Sysmon Event ID 1 for the original command line.
Threat Hunting Queries
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 12
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc- Data source
- Microsoft Sentinel Event table
- Assumptions
- The Sysmon Operational channel is collected into Event. Map raw XML fields to the event-specific fields described on this page.
index=sysmon source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=12
| table _time, host, EventCode, Message- Data source
- Splunk Sysmon event data
- Assumptions
- Index, source, and parsed field names vary by deployment. Apply the event-specific field conditions after validating local field extraction.
dataset = microsoft_windows_raw
| filter edr_event_id = 12- Data source
- Cortex XDR microsoft_windows_raw
- Assumptions
- Confirm Provider is Microsoft-Windows-Sysmon because event IDs are not globally unique. Inspect raw provider fields because parsed names vary by collection path.
title: Sysmon Event ID 12
status: experimental
logsource:
product: windows
service: sysmon
detection:
selection:
EventID: 12
condition: selection
falsepositives:
- Legitimate administrative or system activity
level: informational- Data source
- Sigma Windows Sysmon log source
- Assumptions
- This rule retrieves the event and is not a standalone malicious-behavior detection. Add the documented field conditions and correlations in the destination SIEM.
Documented Values and Codes
| Field | Value | Meaning | Security relevance |
|---|---|---|---|
| EventType | CreateKey | A registry key or value object was created. | Use EventType together with the other documented event fields and correlated activity; this value alone is not proof of compromise. Source |
| EventType | DeleteKey | A registry key or value object was deleted. | Use EventType together with the other documented event fields and correlated activity; this value alone is not proof of compromise. Source |
MITRE ATT&CK Mapping
- T1112Modify Registry
Detection Notes
Alert when EventType=CreateKey or EventType=DeleteKey touches HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run, HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run, or HKLM\\System\\CurrentControlSet\\Services from an Image outside the approved software deployment baseline. Sysinternals documents Event 12 for registry object create/delete activity and uses HKLM/HKU/HKCR abbreviations, so these TargetObject values are directly observable. Creation in Run or Services can establish persistence, while deletion can remove forensic or defensive configuration; map this to T1112 Modify Registry and correlate ProcessGuid to Event 1 for the full command line.
Common False Positives
- Approved administration, management agents, and deployment tools can generate this telemetry.
- Baseline expected hosts, signed binaries, and change windows before suppression.
Related Events
Sample Log
UtcTime: 2026-07-13 01:00:00.000
EventType: CreateKey
TargetObject: HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Updater
Image: C:\\Users\\Public\\updater.exe
ProcessGuid: {REDACTED}Frequently Asked Questions
What does Sysmon Event ID 12 mean?
A process created or deleted a registry key or value object.
Does Event ID 12 always indicate malicious activity?
No. Installers, updates, policy clients, and applications routinely create and delete registry objects.
How should Event ID 12 be investigated?
Inspect EventType, TargetObject, Image, and ProcessGuid, focusing on autostart, service, and security-control paths.
Sources
- 12: RegistryEvent (Object create/delete)
Microsoft Sysinternals · vendor
- Modify Registry (T1112)
MITRE ATT&CK · attack
- XDR Collector datasets
Palo Alto Networks · vendor
- Sigma Rules Specification
SigmaHQ · detection rule