Sysmon Event ID 13: RegistryEvent (Value Set)
Sysmon Event ID 13 records registry value modifications.
- Applicable version
- Sysmon with this event enabled
- Last reviewed
- 2026-07-13
Trigger Scenarios
Sysmon emits this event when a configured RegistryEvent rule observes a registry value being set. Microsoft documents that the event records the written value for DWORD and QWORD registry value types.
Key Fields
TargetObject
The registry value path uses Sysmon's abbreviated root names such as HKLM and HKU. Autorun, Office security, and Defender policy locations are high-value targets for persistence and defense evasion.
Details
Contains the value written for DWORD and QWORD registry value types according to Microsoft. A written path under C:\\Users\\, C:\\ProgramData\\, or C:\\Windows\\Temp can reveal a user-writable payload location.
Image / ProcessGuid
Identifies the process that set the value and provides a stable join key to Sysmon Event ID 1 for command-line context.
Common False Positives
- Approved administration, management agents, and deployment tools can generate this telemetry.
- Baseline expected hosts, signed binaries, and change windows before suppression.
Related Events
MITRE ATT&CK Mapping
- T1112Modify Registry
Detection Notes
Alert when TargetObject is HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and Details points to C:\\Users\\, C:\\ProgramData\\, C:\\Windows\\Temp, or another user-writable path. Microsoft documents Event 13 as registry value modification telemetry and notes that DWORD/QWORD written values are captured, so the TargetObject plus Details pair can directly show an autorun payload or a defense-evasion value change. This supports T1112 Modify Registry; correlate ProcessGuid to Event 1 and verify whether the Image is an approved installer or management agent.
Sysmon
| where EventID == 13
| project TimeGenerated, Computer, Image, ProcessGuidindex=sysmon EventCode=13 | table _time, host, Image, ProcessGuidUtcTime: 2026-07-13 01:00:00.000
EventType: SetValue
TargetObject: HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Updater
Details: C:\\ProgramData\\updater.exe
Image: C:\\Users\\Public\\updater.exe
ProcessGuid: {REDACTED}