Windows Registry Key Deletion — Detection Telemetry

Collection and providers

Collect RegistryEvent (12), distinguishing DeleteKey/DeleteValue from create operations. Event 13 is value-set activity, not deletion.

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.

Configuration

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• Keep this Windows-specific source separate from other operating systems; there is no direct cross-platform event-ID equivalence.

Synthetic event example

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0045",
  "collector": "illustrative-lab-collector",
  "observation": {
    "registry_path": "HKCU\\Software\\Lab\\Demo",
    "event_type": "DeleteKey",
    "process_id": 4200
  }
}

Visibility and validation

Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

• Record the lab scope, collector version, effective configuration and expected source fields before testing.
• Use an approved benign action or read-only snapshot appropriate to this type. For destructive, privileged or physical effects, use a reviewed fixture or existing authorized evidence instead of causing the effect.
• Verify the native source record locally and at the collector; compare timestamps, identity, object, action/result and the type-specific fields listed below. Save a redacted real capture separately from the synthetic example.
• Check a normal baseline and collector-loss case. Fixture parsing proves parser behavior only; it does not prove sensor coverage or malicious-behavior detection.

Primary sources

• Microsoft Sysmon events and configuration
• Microsoft Sysmon configuration files