Log Dejargonizer

Sysmon · Event 12

Sysmon Event 12: A registry key was created or deleted

A registry key was created or removed. It pairs with Event 13, which records the values written into those keys, and the deletion half is the more interesting one — removing a key is how evidence and security settings both disappear.

Also written as Sysmon 12Sysmon Event ID 12

What it means for you

For an analyst

Read the EventType field to distinguish creation from deletion — they are the same event ID and mean quite different things. Deletion of service keys, security product configuration, or Sysmon's own configuration is worth alerting on.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
Registry object added or deleted:
  RuleName: -
  EventType: DeleteKey
  UtcTime: 2026-08-28 09:20:44.019
  ProcessGuid: {a1b2c3d4-0000-0000-0000-00000000abcd}
  ProcessId: 7412
  Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  TargetObject: HKLM\System\CurrentControlSet\Services\WinHelpSvc
  User: CORP\jbrooks

The fields that decide it

Everything else in the log line is context.

EventType
CreateKey or DeleteKey. This distinction is the whole event.
  • DeleteKeySomething was removed. In a security-relevant location this is the interesting case.
  • CreateKeyOrdinary and very high volume.
TargetObject
The registry key path.
Image
The process that made the change.

Ordinary reasons this happens

Most of the time it is one of these.

  • Software installation and uninstallation.
  • Windows creating and removing configuration keys during normal operation.
  • Group Policy processing.
  • Application first-run setup.

When it is not ordinary

Removing evidence of persistence.

What gives it awayDeletion of keys the same actor created earlier, particularly autostart keys.

ATT&CK T1070

Disabling a security product by removing its configuration.

What gives it awayDeletion of keys under a security product's configuration path by an unexpected process.

ATT&CK T1562.001

Removing service registrations after use.

What gives it awayDeletion of a service key shortly after that service was installed and started.

ATT&CK T1070

What to do next

  1. Read EventType first — creation and deletion need different reactions.
  2. Check whether the key path is security-relevant.
  3. Identify the process and join on ProcessGuid for its command line.
  4. For deletions, check whether the same key was created recently and by what.
  5. Check whether a software uninstall was running at the time.

Queries to run

kql Deletions in the locations that matter. 
Event | where Source == 'Microsoft-Windows-Sysmon' and EventID == 12 | where RenderedDescription has 'DeleteKey' | where TargetObject has_any ('\\Services\\','Windows Defender','\\Run\\') | project TimeGenerated, Computer, Image, TargetObject

Common questions

How do I tell a registry key creation from a deletion in Sysmon Event 12?

Read the EventType field, which is either CreateKey or DeleteKey. Both share event ID 12, and rules that ignore EventType will match creations they did not intend to — which is most of the volume.

Read next

Vendor documentation

Last reviewed 28 August 2026