The registry is a system-defined database in which applications and system components store and retrieve configuration data. The data stored in the registry varies according to the version of Microsoft Windows. Applications use the registry API to retrieve, modify, or delete registry data.

Actions

|Action|Description| |—|—| |add|The event corresponding to the act of adding a registry key, hive, type, or value.| |key_edit|The event corresponding to the act of editing the name of an existing registry key.| |remove|The event corresponding to the act of deleting an existing registry key, hive, type, or value.| |value_edit|The event corresponding to the act of editing the content of an existing registry value.|

Fields

|Field|Description|Example| |—|—|—| data|The content of value, typically a text string.|\%SystemRoot%\system32\svchost.exe -k rpcss fqdn|The fully qualified domain name for the host on which the registry access took place.|HOST1.EXAMPLE_DOMAIN.COM hive|The logical group of keys, subkeys, and values in the registry.|HKEY_CURRENT_USER hostname|The hostname of the host, without the domain.|HOST1 image_path|Inherited from the process that made the registry access.|C:\path\to\example.exe key|The registry key of the event. Similar to a folder in a traditional file system.|HKLM\SYSTEM\CurrentControlSet\services\RpcSs new_content|The data within the new value, or the new name of a key, after an edit event.|\%SystemRoot%\system32\svchost.exe, HKLM\SYSTEM\CurrentControlSet\services\RpcSs pid|Inherited from the process that made the registry access.|738 type|The type of data being stored in value. Types include binary data, 32 bit numbers, strings, etc.|REG_BINARY user|The user in the context of the process that performed the action on the registry key.|HOST1\LOCALUSER value|The descriptive name for the data being stored.|InstalledVersion

Coverage Map

data fqdn hive hostname image_path key new_content pid type user value
add Autoruns&#10Sysmon Sysmon Autoruns&#10Sysmon Autoruns Sysmon Autoruns&#10Sysmon Sysmon Autoruns Sysmon Autoruns
key_edit Autoruns&#10Sysmon Sysmon Autoruns&#10Sysmon Autoruns Sysmon Autoruns&#10Sysmon Autoruns&#10Sysmon Sysmon Autoruns Sysmon Autoruns&#10Sysmon
remove Sysmon Sysmon Sysmon Sysmon Sysmon Sysmon Sysmon
value_edit Autoruns Autoruns Autoruns Autoruns Autoruns Autoruns Autoruns