13 Sysmon log · RegistryEvent medium severity high volume

Sysmon Event ID 13 — Registry value set

Registry value was set. TargetObject (full path) and Details (new value) are key. Most useful registry event — shows actual value content.

Why event 13 matters

Same as Sysmon 12 but captures the actual value written. PowerShell encoded payloads stored in registry (fileless malware). COM hijacking by setting registry values. Security tool disable (AV registry switches). ASEP (AutoStart Extension Points) abuse.

How to detect it

Alert: Details contains PowerShell encoded commands or base64 strings in Run keys. Alert: Sysmon configuration value changes. Alert: IFEO (Image File Execution Options) value set for debugger hijacking. High value when combined with TargetObject path filtering.

Log source
Microsoft-Windows-Sysmon/Operational
Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).
Fields to pivot on
ImageTargetObjectDetails

MITRE ATT&CK mapping

Tactic Technique
Persistence Registry Run Keys (T1547.001)
Defense Evasion Modify Registry (T1112)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule
title: Suspicious Registry Value Set in Run Key
status: stable
description: Value set in common persistence registry location
author: theadminstack.com
date: 2026/05/16
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        EventID: 13
        TargetObject|contains:
            - '\\Run\\'
            - '\\RunOnce\\'
            - '\\Winlogon\\'
    condition: selection
falsepositives:
    - Software installers
    - Windows Update
level: medium
tags:
    - attack.persistence
    - attack.t1547.001
Sentinel / Defender KQL
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 13   // Registry value set
// EventData holds: Image, TargetObject, Details
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Registry value set — add EventData fields: Image, TargetObject, Details`
Hunt event 13 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Related RegistryEvent events

12 Registry object added or deleted 14 Registry object renamed

Frequently asked questions

What is Sysmon Event ID 13?

Registry value set. Registry value was set. TargetObject (full path) and Details (new value) are key. Most useful registry event — shows actual value content.

Which log records event 13?

Event 13 is written to the Microsoft-Windows-Sysmon/Operational channel by Microsoft-Windows-Sysmon. Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

What MITRE ATT&CK techniques map to event 13?

Event 13 is associated with: Registry Run Keys (T1547.001), Modify Registry (T1112).

How do you detect activity around event 13?

Alert: Details contains PowerShell encoded commands or base64 strings in Run keys. Alert: Sysmon configuration value changes. Alert: IFEO (Image File Execution Options) value set for debugger hijacking. High value when combined with TargetObject path filtering.