Which Windows Event ID Tracks Registry Value Changes?
Maria has executed a suspicious executable file in a controlled environment and wants to see if the file adds/modifies any registry value after execution via Windows Event Viewer. Which of the following event ID should she look for in this scenario?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests knowledge of Windows security auditing event IDs, and the trap is confusing registry-change auditing (4657) with process-creation (4688), service-change (7040), or logon (4624) events.
When analyzing a suspicious executable in a controlled Windows environment, analysts can use Event Viewer to detect registry modifications. Event ID 4657 is logged when a registry value (object attribute) is changed, making it the correct choice for confirming that the malware added or modified a registry entry.
Learners often pick Event ID 4688 because executing a suspicious file immediately creates a new process, but 4688 only proves execution — it does not reveal whether any registry value was added or modified.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Event ID 4657 is generated when an audited object's attribute is modified, and registry values are treated as object attributes, so a change to a registry value produces this event. The entry includes the object name (registry key path), the attribute (value name), plus the old and new data, which is exactly the evidence Maria needs to prove the executable added or modified a registry value. Because the question explicitly asks about registry value additions/modifications after execution, 4657 is the only option that directly answers it, and the unanimous community vote and Elb's note that "4657 A registry value was modified" both align with this.Why the Other Options Are Wrong
Event ID 4688 records creation of a new process, which confirms the executable ran but says nothing about registry writes, so it answers a different question. Event ID 7040 indicates a service configuration (start type) changed, which is logged by the service control manager rather than registry auditing and only applies if a service was altered. Event ID 4624 records a successful account logon, an authentication event irrelevant to observing registry modifications in a sandbox. Note that 4657 auditing requires enabling the Audit Registry subkey/registry value auditing policy in the controlled environment before execution.Community Comment Notes
All 100 recorded votes and every substantive comment select A, with 044f354 laying out each option's meaning: "A. Event ID 4657 Description: A registry value was modified". aqeel1506 adds that 4657 "provides information about what was changed, including the old and new values," reinforcing its usefulness for tracking registry changes. The comments consistently distinguish 4688 as process creation and 7040 as service change, matching the analysis above.Official Reference
Exam Strategy
Memorize the 46xx audit family by what each triggers: 4624 logon, 4688 process creation, 4657 object/registry attribute change — then match the verb in the question stem ('adds/modifies registry value') to the event that records attribute modification.
Frequently Asked Questions
Why doesn't Event ID 4688 show registry modifications?
4688 only records that a new process was created; it proves execution but carries no data about which registry keys or values the process touched.
Do I need special configuration for Event ID 4657 to appear?
Yes. Registry auditing must be enabled (audit policy plus SACL on the relevant keys) before running the file, otherwise no 4657 events are generated.