Windows Registry Key Access (ed0dd8aa-1677-4551-bb7d-8da767617e1b)
The action of opening a specific Windows Registry key, typically to read its associated value. This activity can be used for system configuration, application settings retrieval, and security policies.
Data Collection Measures:
- Windows Event Logs
- Event ID 4656 - Handle to an Object was Requested: Logs attempts to open registry keys.
- Event ID 4663 - An Object was Accessed: Captures read/write operations on registry keys.
- Event ID 4657 - Registry Value Modification: Useful for detecting changes to registry keys after being accessed.
- Sysmon
- Sysmon Event ID 13 - Registry Value Set: Captures modifications to existing registry keys.
- Endpoint Detection and Response (EDR) Solutions
- Provide telemetry on registry key access activities, especially when linked to suspicious processes.