Event ID 9005003 — Registry value set
Description
Registry value set
Fields #
| Name | Description |
|---|---|
DeviceId | — |
Timestamp | — |
RegistryKey | — |
RegistryValueName | — |
RegistryValueData | — |
PreviousRegistryValueData | — |
InitiatingProcessFileName | — |
Detection Patterns #
Uac Bypass
Defender-DeviceRegistryEvents Event ID 9005000: Registry activity→Event ID 9005002: Registry key deleted→Event ID 9005003: Registry value set→Event ID 9005004: Registry value deleted→Security-Auditing Event ID 4657: A registry value was modified.→Event ID 4660: An object was deleted.→Event ID 4663: An attempt was made to access an object.→Sysmon Event ID 12: RegistryEvent→Event ID 13: RegistryEvent→Event ID 14: RegistryEvent
5 rules
Kusto Query Language
Defense Evasion: Impair Defenses
Defender-DeviceRegistryEvents Event ID 9005003: Registry value setORSecurity-Auditing Event ID 4657: A registry value was modified.ORSysmon Event ID 13: RegistryEvent
1 rule
Kusto Query Language
References #
- Microsoft Defender XDR — advanced hunting reference https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceregistryevents-table