Event ID 4657RegistryP2

Windows Event ID 4657: A registry value was modified

Event ID 4657 records modification of an audited registry value.

Applicable version: Windows Server 2008 R2 and later; Windows 7 and later
Last reviewed: 2026-07-11

Trigger Scenarios

It requires a SACL on the affected registry key and Object Access auditing.

Key Fields

Object Name

The modified registry path.

Object Value Name

The changed value; focus on autorun and security-policy values.

Old Value / New Value

The before-and-after data identifies the actual persistence or defense change.

Common False Positives

Installers and policy management modify registry values.
Legitimate software updates can alter autorun configuration.

Related Events

MITRE ATT&CK Mapping

T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Detection Notes

T1547.001 persistence is indicated when Object Name is HKLM or HKCU\Software\Microsoft\Windows\CurrentVersion\Run or RunOnce and New Value points to a script, LOLBin, or user-writable executable. Capture Old Value and New Value and pivot to the process that made the change.

Microsoft Sentinel KQL

SecurityEvent
| where EventID == 4657
| where ObjectName has @"\CurrentVersion\Run"
| project TimeGenerated, Computer, Account, ObjectName, ObjectValueName, NewValue

Splunk SPL

index=wineventlog EventCode=4657 Object_Name="*\CurrentVersion\Run*" | table _time, host, Object_Name, Object_Value_Name, New_Value

Sample Log

Object Name: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Object Value Name: Updater
New Value: C:\Users\Public\updater.exe

Source

Official documentation Machine-readable JSON