14 Sysmon log · RegistryEvent low severity low volume

Sysmon Event ID 14 — Registry object renamed

Registry key or value was renamed.

Why event 14 matters

Renaming registry keys as anti-analysis obfuscation. Attackers rename their persistence registry keys to mimic legitimate entries.

How to detect it

Alert: renames in Run keys, Services, or security-relevant locations.

Log source
Microsoft-Windows-Sysmon/Operational
Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).
Fields to pivot on
ImageCommandLineParentImageUserHashes

MITRE ATT&CK mapping

Tactic Technique
Defense Evasion Modify Registry (T1112)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 14   // Registry object renamed
// EventData holds: Image, CommandLine, ParentImage, User, Hashes
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=14
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Registry object renamed — add EventData fields: Image, CommandLine, ParentImage, User`
Hunt event 14 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Related RegistryEvent events

12 Registry object added or deleted 13 Registry value set

Frequently asked questions

What is Sysmon Event ID 14?

Registry object renamed. Registry key or value was renamed.

Which log records event 14?

Event 14 is written to the Microsoft-Windows-Sysmon/Operational channel by Microsoft-Windows-Sysmon. Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

What MITRE ATT&CK techniques map to event 14?

Event 14 is associated with: Modify Registry (T1112).

How do you detect activity around event 14?

Alert: renames in Run keys, Services, or security-relevant locations.