Sysmon Event ID 13: RegistryEvent (Value Set)
- Applicable version
- Sysmon with this event enabled
- Last reviewed
- 2026-07-21
Quick summary
Sysmon Event ID 13 records registry value modifications.
Technical Metadata
| Event ID | 13 |
|---|---|
| Provider | Microsoft-Windows-Sysmon |
| Channel | Microsoft-Windows-Sysmon/Operational |
| Level | Informational |
| MITRE ATT&CK | TA0005 Defense Evasion / T1112 Modify Registry |
| Key fields to watch | TargetObject, Details, Image / ProcessGuid |
Trigger Scenarios
Sysmon emits this event when a configured RegistryEvent rule observes a registry value being set. Microsoft documents that the event records the written value for DWORD and QWORD registry value types.
Key Fields
TargetObject
The registry value path uses Sysmon's abbreviated root names such as HKLM and HKU. Autorun, Office security, and Defender policy locations are high-value targets for persistence and defense evasion.
Details
Contains the value written for DWORD and QWORD registry value types according to Microsoft. A written path under C:\\Users\\, C:\\ProgramData\\, or C:\\Windows\\Temp can reveal a user-writable payload location.
Image / ProcessGuid
Identifies the process that set the value and provides a stable join key to Sysmon Event ID 1 for command-line context.
Threat Hunting Queries
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 13
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc- Data source
- Microsoft Sentinel Event table
- Assumptions
- The Sysmon Operational channel is collected into Event. Map raw XML fields to the event-specific fields described on this page.
index=sysmon source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13
| table _time, host, EventCode, Message- Data source
- Splunk Sysmon event data
- Assumptions
- Index, source, and parsed field names vary by deployment. Apply the event-specific field conditions after validating local field extraction.
dataset = microsoft_windows_raw
| filter edr_event_id = 13- Data source
- Cortex XDR microsoft_windows_raw
- Assumptions
- Confirm Provider is Microsoft-Windows-Sysmon because event IDs are not globally unique. Inspect raw provider fields because parsed names vary by collection path.
title: Sysmon Event ID 13
status: experimental
logsource:
product: windows
service: sysmon
detection:
selection:
EventID: 13
condition: selection
falsepositives:
- Legitimate administrative or system activity
level: informational- Data source
- Sigma Windows Sysmon log source
- Assumptions
- This rule retrieves the event and is not a standalone malicious-behavior detection. Add the documented field conditions and correlations in the destination SIEM.
Documented Values and Codes
| Field | Value | Meaning | Security relevance |
|---|---|---|---|
| EventType | SetValue | A process modified a registry value. | Use EventType together with the other documented event fields and correlated activity; this value alone is not proof of compromise. Source |
| Details | DWORD/QWORD value | Sysmon records the written data for DWORD and QWORD registry value types. | Use Details together with the other documented event fields and correlated activity; this value alone is not proof of compromise. Source |
MITRE ATT&CK Mapping
- T1112Modify Registry
Detection Notes
Alert when TargetObject is HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and Details points to C:\\Users\\, C:\\ProgramData\\, C:\\Windows\\Temp, or another user-writable path. Microsoft documents Event 13 as registry value modification telemetry and notes that DWORD/QWORD written values are captured, so the TargetObject plus Details pair can directly show an autorun payload or a defense-evasion value change. This supports T1112 Modify Registry; correlate ProcessGuid to Event 1 and verify whether the Image is an approved installer or management agent.
Common False Positives
- Approved administration, management agents, and deployment tools can generate this telemetry.
- Baseline expected hosts, signed binaries, and change windows before suppression.
Related Events
Sample Log
UtcTime: 2026-07-13 01:00:00.000
EventType: SetValue
TargetObject: HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Updater
Details: C:\\ProgramData\\updater.exe
Image: C:\\Users\\Public\\updater.exe
ProcessGuid: {REDACTED}Frequently Asked Questions
What does Sysmon Event ID 13 mean?
A process set or modified a registry value.
Does Event ID 13 always indicate malicious activity?
No. Normal applications and management agents make frequent registry changes.
How should Event ID 13 be investigated?
Evaluate TargetObject and Details, then join ProcessGuid to Event 1 to identify the responsible command line.
Sources
- 13: RegistryEvent (Value Set)
Microsoft Sysinternals · vendor
- Modify Registry (T1112)
MITRE ATT&CK · attack
- XDR Collector datasets
Palo Alto Networks · vendor
- Sigma Rules Specification
SigmaHQ · detection rule