SOC Event Lookup
Event ID 4657RegistryP2

Windows Event ID 4657: A registry value was modified

Applicable version
Windows Server 2008 R2 and later; Windows 7 and later
Last reviewed
2026-07-21

Quick summary

Event ID 4657 records modification of an audited registry value.

Technical Metadata

Technical metadata for Event ID 4657
Event ID4657
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success
MITRE ATT&CKTA0003 Persistence / T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Key fields to watchObject Name, Object Value Name, Old Value / New Value

Trigger Scenarios

It requires a SACL on the affected registry key and Object Access auditing.

Key Fields

Object Name

The modified registry path.

Object Value Name

The changed value; focus on autorun and security-policy values.

Old Value / New Value

The before-and-after data identifies the actual persistence or defense change.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Event ID 4657
SecurityEvent
| where EventID == 4657
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
Query reference
Splunk SPL: Retrieve Windows Event ID 4657
index=wineventlog source="WinEventLog:Security" EventCode=4657
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
Cortex XQL: Retrieve Windows Event ID 4657
dataset = microsoft_windows_raw
| filter edr_event_id = 4657
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 4657
title: Windows Security Event ID 4657
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4657
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
ObjectNameHKCU\Software\Microsoft\Windows\CurrentVersion\RunThe per-user Run key starts configured commands when that user logs on.A newly added value pointing to a script, LOLBin, or user-writable executable can establish logon persistence. Source
ObjectNameHKLM\Software\Microsoft\Windows\CurrentVersion\RunThe machine Run key applies logon startup configuration across users.Unexpected modification has broader persistence impact and should be joined to the writer process and prior value. Source

MITRE ATT&CK Mapping

  • T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Detection Notes

T1547.001 persistence is indicated when ObjectName is HKCU\Software\Microsoft\Windows\CurrentVersion\Run or HKLM\Software\Microsoft\Windows\CurrentVersion\Run and NewValue points to a script, LOLBin, or user-writable executable. Compare OldValue with NewValue and correlate ProcessId and SubjectLogonId to 4688 before deciding whether the change came from approved software installation.

Common False Positives

  • Installers and policy management modify registry values.
  • Legitimate software updates can alter autorun configuration.

Related Events

Sample Log

Sanitized event sample
Object Name: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Object Value Name: Updater
New Value: C:\Users\Public\updater.exe

Frequently Asked Questions

What does Windows Event ID 4657 mean?

Event ID 4657 records creation, modification, or deletion of a registry value when the value's SACL requests Set Value auditing.

Why might Event ID 4657 be missing for a registry change?

Registry object-access auditing and a matching SACL must be configured; absence of the event does not prove that no registry modification occurred.

Which 4657 fields matter for Run-key persistence?

ObjectName, ObjectValueName, OldValue, NewValue, ProcessName, and SubjectLogonId show where the value changed, its before-and-after data, and the responsible context.

Sources