Sysmon Event ID 12 — Registry object added or deleted — SecOps Tools

Why event 12 matters

Registry-based persistence (Run keys, Services, COM objects). Defense evasion (deleting security tool registry keys). Credential access (modifying LSA security packages). TargetObject reveals the specific registry path being manipulated.

How to detect it

Alert: Run/RunOnce key modifications. Alert: HKLM\SYSTEM\CurrentControlSet\Services modifications. Alert: LSA security package changes (HKLM\SYSTEM\CurrentControlSet\Control\Lsa). Very high volume — focus on specific high-value paths.

Log source

Microsoft-Windows-Sysmon/Operational

Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

Fields to pivot on

ImageCommandLineParentImageUserHashes

MITRE ATT&CK mapping

Tactic	Technique
Persistence	Registry Run Keys (T1547.001)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL

Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 12   // Registry object added or deleted
// EventData holds: Image, CommandLine, ParentImage, User, Hashes
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc

Splunk SPL

index=* sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=12
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Registry object added or deleted — add EventData fields: Image, CommandLine, ParentImage, User`

Hunt event 12 in Sentinel/Defender →

Build a KQL query for this event in the KQL Query Builder.

Search all event IDs →

Open the interactive Windows Event ID lookup.

Related RegistryEvent events

13 Registry value set 14 Registry object renamed

Frequently asked questions

What is Sysmon Event ID 12?

Registry object added or deleted. Registry key or value created or deleted. EventType, TargetObject are key.

Which log records event 12?

Event 12 is written to the Microsoft-Windows-Sysmon/Operational channel by Microsoft-Windows-Sysmon. Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

What MITRE ATT&CK techniques map to event 12?

Event 12 is associated with: Registry Run Keys (T1547.001).

How do you detect activity around event 12?