Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
- Applicable version
- Sysmon with this event enabled
- Last reviewed
- 2026-07-22
Quick summary
Sysmon Event ID 14 records registry key and value rename operations.
Technical Metadata
| Event ID | 14 |
|---|---|
| Provider | Microsoft-Windows-Sysmon |
| Channel | Microsoft-Windows-Sysmon/Operational |
| Level | Informational |
| MITRE ATT&CK | TA0005 Defense Evasion / T1112 Modify Registry |
| Key fields to watch | TargetObject, NewName, Image / ProcessGuid |
Trigger Scenarios
Microsoft documents that registry key and value rename operations map to this event type and record the new name of the renamed key or value.
Key Fields
TargetObject
The registry object being renamed. Public Sysmon field references identify this as the original key or value path.
NewName
The new key or value name recorded for the rename operation.
Image / ProcessGuid
The process that performed the rename and the stable join key to Event ID 1.
Threat Hunting Queries
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 14
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc- Data source
- Microsoft Sentinel Event table
- Assumptions
- The Sysmon Operational channel is collected into Event. Map raw XML fields to the event-specific fields described on this page.
index=sysmon source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=14
| table _time, host, EventCode, Message- Data source
- Splunk Sysmon event data
- Assumptions
- Index, source, and parsed field names vary by deployment. Apply the documented field conditions after validating local field extraction.
dataset = microsoft_windows_raw
| filter edr_event_id = 14- Data source
- Cortex XDR microsoft_windows_raw
- Assumptions
- Confirm Provider is Microsoft-Windows-Sysmon because event IDs are not globally unique. Inspect raw provider fields because parsed names vary by collection path.
title: Sysmon Event ID 14
status: experimental
logsource:
product: windows
service: sysmon
detection:
selection:
EventID: 14
condition: selection
falsepositives:
- Legitimate administrative or system activity
level: informational- Data source
- Sigma Windows Sysmon log source
- Assumptions
- This rule retrieves the event and is not a standalone malicious-behavior detection. Add the event-specific conditions and correlations documented on this page.
Documented Values and Codes
| Field | Value | Meaning | Security relevance |
|---|---|---|---|
| EventID | 14 | A registry key or value was renamed. | Interpret EventID with the other documented fields and correlated events; this value alone is not proof of compromise. Source |
| TargetObject | HKLM\ | Sysmon abbreviates HKEY_LOCAL_MACHINE as HKLM in registry events. | Interpret TargetObject with the other documented fields and correlated events; this value alone is not proof of compromise. Source |
MITRE ATT&CK Mapping
- T1112Modify Registry
Detection Notes
Alert when TargetObject or NewName is under HKLM\Software\Microsoft\Windows\CurrentVersion\Run, HKCU\Software\Microsoft\Windows\CurrentVersion\Run, or HKLM\System\CurrentControlSet\Services and the Image is not an approved installer. Microsoft documents Event 14 as registry rename telemetry, and Sysmon documents HKLM/HKU/HKCR registry-root abbreviations for registry events. Renaming a persistence value can hide or activate autostart material, supporting T1112 Modify Registry; correlate ProcessGuid to Event 1 and adjacent Events 12/13.
Common False Positives
- Installers and management tools can rename registry values during upgrades.
- Application configuration migrations can rename values under vendor-owned keys.
Related Events
Sample Log
UtcTime: 2026-07-13 03:02:00.000
Image: C:\Users\Public\regtool.exe
TargetObject: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\OldName
NewName: Updater
ProcessGuid: {REDACTED}Frequently Asked Questions
What does Sysmon Event ID 14 mean?
A process renamed a registry key or value.
Does Event ID 14 always indicate malicious activity?
No. Installers, updates, and applications frequently reorganize registry data.
How should Event ID 14 be investigated?
Review TargetObject, NewName, Image, and ProcessGuid, focusing on persistence and security-policy paths.
Sources
- 14: RegistryEvent (Key and Value Rename)
Microsoft Sysinternals · vendor
- Modify Registry (T1112)
MITRE ATT&CK · attack
- XDR Collector datasets
Palo Alto Networks · vendor
- Sigma Rules Specification
SigmaHQ · detection rule