admin/trustedsec-SysmonCommunityGuide
1
0
Fork 0
mirror of https://github.com/trustedsec/SysmonCommunityGuide/ synced 2026-06-06 19:46:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #16 from Jarrod-L/patch-8

Browse Source 
small typo fixes in registry-actions.md
This commit is contained in:
Carlos Perez
2020-02-11 15:43:26 -04:00
committed by GitHub
parent 19e9a89be4 542f38ff71
commit 3e64750d62
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
registry-actions.md
+3 -2
View File
@@ -1,13 +1,14 @@
Registry Actions
================
Sysmon has the capability to monitor for three major actions against Registry
Sysmon has the capability to monitor for three major actions against the Registry
* **EventID 12** - Registry object added or deleted
* **EventID 13** - Registry value set
* **EventID 14** - Registry object renamed
The Windows Registry has been a source of information gathering, persistence, storage, and configuration control for attackers since its wider use introduction in Windows NT 4.0/Windows 95.
Sysmon uses abbreviated versions of Registry root key names, with the following mappings:
@@ -81,7 +82,7 @@ In registry events, the value name is appended to the full key path with a \"\\\
Default key values are named \"\\(Default)\"
When filtering for keys or values in HKCU, use **contains** or **end with** when filtering against **TargetObject** since the SID of the user is appended after the Hive name.
When filtering for keys or values in HKCU, use **contains** or **ends with** when filtering against **TargetObject** since the SID of the user is appended after the Hive name.
![HKCU Test](./media/image51.png)