Log Dejargonizer

Sysmon · Event 12

Sysmon Event 12: A registry key was created or deleted

A registry key was created or removed. It pairs with Event 13, which records the values written into those keys, and the deletion half is the more interesting one — removing a key is how evidence and security settings both disappear.

Also written as Sysmon 12Sysmon Event ID 12

What it means for you

For an analyst

Read the EventType field to distinguish creation from deletion — they are the same event ID and mean quite different things. Deletion of service keys, security product configuration, or Sysmon's own configuration is worth alerting on.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
Registry object added or deleted:
  RuleName: -
  EventType: DeleteKey
  UtcTime: 2026-08-28 09:20:44.019
  ProcessGuid: {a1b2c3d4-0000-0000-0000-00000000abcd}
  ProcessId: 7412
  Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  TargetObject: HKLM\System\CurrentControlSet\Services\WinHelpSvc
  User: CORP\jbrooks

The fields that decide it

Everything else in the log line is context.

EventType
CreateKey or DeleteKey. This distinction is the whole event.
  • DeleteKeySomething was removed. In a security-relevant location this is the interesting case.
  • CreateKeyOrdinary and very high volume.
TargetObject
The registry key path.
Image
The process that made the change.

Ordinary reasons this happens

Most of the time it is one of these.

  • Software installation and uninstallation.
  • Windows creating and removing configuration keys during normal operation.
  • Group Policy processing.
  • Application first-run setup.

When it is not ordinary

Removing evidence of persistence.

What gives it awayDeletion of keys the same actor created earlier, particularly autostart keys.

ATT&CK T1070

Disabling a security product by removing its configuration.

What gives it awayDeletion of keys under a security product's configuration path by an unexpected process.

ATT&CK T1562.001

Removing service registrations after use.

What gives it awayDeletion of a service key shortly after that service was installed and started.

ATT&CK T1070

What to do next

  1. Read EventType first — creation and deletion need different reactions.
  2. Check whether the key path is security-relevant.
  3. Identify the process and join on ProcessGuid for its command line.
  4. For deletions, check whether the same key was created recently and by what.
  5. Check whether a software uninstall was running at the time.

Queries to run

kql Deletions in the locations that matter. 
Event | where Source == 'Microsoft-Windows-Sysmon' and EventID == 12 | where RenderedDescription has 'DeleteKey' | where TargetObject has_any ('\\Services\\','Windows Defender','\\Run\\') | project TimeGenerated, Computer, Image, TargetObject

Common questions

How do I tell a registry key creation from a deletion in Sysmon Event 12?

Read the EventType field, which is either CreateKey or DeleteKey. Both share event ID 12, and rules that ignore EventType will match creations they did not intend to — which is most of the volume.

Why does Sysmon abbreviate registry paths?

Sysmon writes the kernel form of the path rather than the familiar one, so HKEY_LOCAL_MACHINE appears as \REGISTRY\MACHINE and HKEY_USERS as \REGISTRY\USER. Rules written against the friendly names silently match nothing. Newer Sysmon versions abbreviate to HKLM and HKU in the rendered output, so check which form your version produces before writing filters.

Is Sysmon Event 12 noisy?

Very, if left unfiltered — Windows creates and deletes registry keys constantly as part of normal operation. It is only usable with a configuration that names the paths worth watching: autorun locations, service definitions, and the shell extension keys. Scoped that way the volume drops to almost nothing and nearly every event means something.

What is the difference between Sysmon Events 12, 13 and 14?

12 records a key being created or deleted, 13 records a value being written, and 14 records a key or value being renamed. Persistence usually needs 12 and 13 together — a key appears and then a value is written into it — while 14 is rarer and often used to hide something by moving it out of the way of whatever is looking.

Read next

Vendor documentation

Last reviewed 28 August 2026