Windows Event ID 4657 — A registry value was modified

Registry value created or modified. ObjectName (full path), OldValue, NewValue are key. Requires registry SACL.

Why event 4657 matters

Persistence via Run/RunOnce keys. Defense evasion via security tool registry modifications. Credential access via LSASS configuration changes. Key paths: HKLM\Software\Microsoft\Windows\CurrentVersion\Run, HKLM\SYSTEM\CurrentControlSet\Services, Winlogon.

How to detect it

Requires SACL on monitored paths. Alert: Run/RunOnce modifications. Alert: Winlogon Userinit or Shell value changes. Configure SACLs on high-value paths rather than broadly.

MITRE ATT&CK mapping

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

SecurityEvent
| where EventID == 4657   // A registry value was modified
| project TimeGenerated, Computer, ObjectName, ObjectValueName, NewValue, ProcessName, SubjectUserName
| sort by TimeGenerated desc

index=* sourcetype="WinEventLog:Security" EventCode=4657
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# A registry value was modified — add EventData fields: ObjectName, ObjectValueName, NewValue, ProcessName`

Related Object Access events