Sysmon 13 — Registry value set

Source and collection

Microsoft-Windows-Sysmon/Operational; native XML export, not an EVTX binary file.

Install Sysmon and review the installed schema and filtering configuration. Use sysmon64 -s to inspect supported fields; preserve the deployed configuration version.

Native example and provenance

upstream test fixture. Published example; no independent capture provenance claimed.

Original publisher / pinned upstream fixture — events[5].event.original

Decoded event.original string; retained the complete Event XML element, excluding any appended rendered message; native XML values unchanged.

Pinned source commit: 9ae756f00f82786ac3496ce99c2dd288c5a5c031

Download the exact sample · Offline research kit

SHA-256: 4eb954713c4e595071f89aedfe5b4dab6ff641996e898f355f34e1b7fee8d94d

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>13</EventID><Version>2</Version><Level>4</Level><Task>13</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2020-05-05T14:57:40.599567200Z'/><EventRecordID>2682</EventRecordID><Correlation/><Execution ProcessID='5496' ThreadID='876'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>vagrant</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>-</Data><Data Name='EventType'>SetValue</Data><Data Name='UtcTime'>2020-05-05 14:57:40.589</Data><Data Name='ProcessGuid'>{5b522f6e-77ae-5eb1-2c03-000000000800}</Data><Data Name='ProcessId'>6072</Data><Data Name='Image'>C:\Windows\regedit.exe</Data><Data Name='TargetObject'>HKU\S-1-5-21-1067164964-2079179834-2367582738-1000\Software\Key 1</Data><Data Name='Details'>DWORD (0x00000004)</Data></EventData></Event>

Structure and field interpretation

EventID

13 in Microsoft-Windows-Sysmon.

UtcTime

Producer-supplied event time.

ProcessGuid

Process correlation identifier where present; case-sensitive field names vary by event.

Relevant fields

ProcessGuid, TargetObject, Details

Investigation uses

• Inspect persistence-sensitive registry value changes and the writing process.
• Correlate ProcessGuid across Sysmon events; keep the host identity and time interval with every join.

Validation boundaries

Not all writes are malicious; determine value type and correlate the original registry location.

This sample passed byte-integrity and JSON/XML parsing checks, including the catalogue’s specified event discriminators. This is not a complete vendor-schema validation or a tested detection.

For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.

Related sources

• Windows Security 4688 — Process creation
• Sysmon 1 — Process creation
• Sysmon 3 — Network connection
• Sysmon 7 — Image loaded
• Sysmon 8 — CreateRemoteThread
• Sysmon 22 — DNS query

Ecosystem connections

• Telemetry Library — ATT&CK data components
• Detection Rules — candidate detection content
• Threat hunting — from intelligence to validated defense
• Practical security learning paths
• AdversaryGraph — evidence-led investigation

References

• Sysmon - Sysinternals | Microsoft Learn
• Sysmon events | Microsoft Learn

Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.