Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
Sysmon Event ID 14 records registry key and value rename operations.
- Applicable version
- Sysmon with this event enabled
- Last reviewed
- 2026-07-13
Trigger Scenarios
Microsoft documents that registry key and value rename operations map to this event type and record the new name of the renamed key or value.
Key Fields
TargetObject
The registry object being renamed. Public Sysmon field references identify this as the original key or value path.
NewName
The new key or value name recorded for the rename operation.
Image / ProcessGuid
The process that performed the rename and the stable join key to Event ID 1.
Common False Positives
- Installers and management tools can rename registry values during upgrades.
- Application configuration migrations can rename values under vendor-owned keys.
Related Events
MITRE ATT&CK Mapping
- T1112Modify Registry
Detection Notes
Alert when TargetObject or NewName is under HKLM\Software\Microsoft\Windows\CurrentVersion\Run, HKCU\Software\Microsoft\Windows\CurrentVersion\Run, or HKLM\System\CurrentControlSet\Services and the Image is not an approved installer. Microsoft documents Event 14 as registry rename telemetry, and Sysmon documents HKLM/HKU/HKCR registry-root abbreviations for registry events. Renaming a persistence value can hide or activate autostart material, supporting T1112 Modify Registry; correlate ProcessGuid to Event 1 and adjacent Events 12/13.
Sysmon
| where EventID == 14
| project TimeGenerated, Computer, Image, TargetObject, NewName, ProcessGuidindex=sysmon EventCode=14 | table _time, host, Image, TargetObject, NewName, ProcessGuidUtcTime: 2026-07-13 03:02:00.000
Image: C:\Users\Public\regtool.exe
TargetObject: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\OldName
NewName: Updater
ProcessGuid: {REDACTED}