Windows Registry Key Access

The action of opening a specific Windows Registry key, typically to read its associated value. This activity can be used for system configuration, application settings retrieval, and security policies.

Data Collection Measures:

• Windows Event Logs
  • Event ID 4656 - Handle to an Object was Requested: Logs attempts to open registry keys.
  • Event ID 4663 - An Object was Accessed: Captures read/write operations on registry keys.
  • Event ID 4657 - Registry Value Modification: Useful for detecting changes to registry keys after being accessed.
• Sysmon
  • Sysmon Event ID 13 - Registry Value Set: Captures modifications to existing registry keys.
• Endpoint Detection and Response (EDR) Solutions
  • Provide telemetry on registry key access activities, especially when linked to suspicious processes.