OpsVantage Tools
Tools Guides Event IDs opsvantage.net
Tools / Event IDs / Sysmon Event ID 13

Sysmon Event ID 13: registry value set

What Sysmon Event ID 13 (registry value set) means, the fields to check, what is normal and what is suspicious, with PowerShell and KQL queries to find it.

Log: Microsoft-Windows-Sysmon/Operational · Severity: Informational · MITRE ATT&CK T1547.001 · Updated 2026-11-03

Sysmon Event ID 13 is written when a registry value is set. The registry is where Windows keeps most of its autostart locations, so this is the event that catches persistence: a Run key pointing at a script in AppData, a hijacked debugger setting, a service path quietly rewritten. Like other Sysmon events it depends on your config, which should watch the keys below.

The fields that matter

FieldWhat it tells you
EventTypeSetValue for this event.
ImageThe process that changed the value.
TargetObjectThe full registry path, which says what kind of change it is.
DetailsThe new value: a path, a command line or a DWORD.

What is normal

Installers and updaters writing their own keys, and familiar apps such as OneDrive and Teams adding themselves to the Run key.

When Sysmon Event ID 13 is suspicious

Common false positive: Software installs and updates touch Run keys and service paths constantly. Signed installers from known vendors writing to their own entries are rarely a concern.

Find Sysmon Event ID 13 with PowerShell

Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=13; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 50 |
  ForEach-Object {
    $d = [ordered]@{ Time = $_.TimeCreated; Computer = $_.MachineName }
    ([xml]$_.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
    [pscustomobject]$d
  } | Format-List

Microsoft Sentinel (KQL)

Event
| where TimeGenerated > ago(7d) and Source == "Microsoft-Windows-Sysmon" and EventID == 13
| project TimeGenerated, Computer, RenderedDescription, EventData
| order by TimeGenerated desc

Related events

FAQ

What is the difference between Sysmon Event ID 12, 13 and 14?

12 is a key or value created or deleted, 13 a value set, 14 a key or value renamed. Persistence usually shows up as 13.

Which registry keys should I monitor?

At least the Run and RunOnce keys, Winlogon, Image File Execution Options, services and Defender exclusions. Community configs such as sysmon-modular include sensible lists.