Registry & Persistence Evidence (EID 12/13)
What is it?
Event IDs 12/13 record registry key/value creation and changes. Attackers use the registry to persist — a Run key, a service, an image-hijack — so these events are where persistence becomes visible.
Why it matters
Execution alone is transient; persistence is what makes an intrusion survive a reboot. Catching the registry write that installs it is how you find and remove the foothold.
Where you see it
An EID 13 shows the process, the TargetObject (the key path) and the new value — e.g. a Run key pointing at C:\Users\Public\svc.exe.
What normal looks like
Installers and updaters writing their own keys during a known change window.
What suspicious looks like
A Run/RunOnce key or a new service pointing at a binary in a user-writable path, written by a process with no business doing so.
How analysts investigate
When you suspect persistence, look at EID 12/13 for writes to autostart locations, check what binary they point to and where it lives, and tie the write back to the process that made it.
Common beginner mistakes
- Treating all registry writes as noise and missing the autostart key.
- Seeing the key but not checking where its target binary lives.
Where the foothold hides
EID13 (registry set):
process: svc.exe
TargetObject: HKLM\...\Run\Updater
Details: C:\Users\Public\svc.exe
→ a Run key launching a Public-path exe at every logon = persistenceQuick check
Which registry write is most likely persistence?
A quick self-check — it doesn't affect your XP or progress.
Sign in to save your progress on the server.