Windows Event ID 4657 – Microsoft-Windows-Security-Auditing: Registry Value Modified

Start by examining the specific Event ID 4657 entry to understand what registry modification occurred.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4657 by right-clicking the Security log and selecting Filter Current Log
4. Enter 4657 in the Event IDs field and click OK
5. Double-click on a 4657 event to view detailed information including:
   • Subject: User account that made the change
   • Object: Registry key and value name
   • Process Information: Executable that performed the modification
   • Change Information: Old and new values
6. Note the Process Name and Process ID to correlate with other security events
7. Check the timestamp to establish a timeline of registry modifications

Use PowerShell to efficiently query and analyze registry modification events across multiple systems.

1. Open PowerShell as Administrator
2. Query recent registry modification events:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4657} -MaxEvents 50 | Select-Object TimeCreated, Id, @{Name='User';Expression={$_.Properties[1].Value}}, @{Name='ProcessName';Expression={$_.Properties[11].Value}}, @{Name='ObjectName';Expression={$_.Properties[6].Value}}

3. Filter for specific registry keys of interest:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4657} | Where-Object {$_.Message -like '*CurrentVersion\Run*'} | Format-Table TimeCreated, @{Name='User';Expression={$_.Properties[1].Value}}, @{Name='KeyPath';Expression={$_.Properties[6].Value}} -AutoSize

4. Export results for analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4657} -MaxEvents 1000 | Export-Csv -Path "C:\Temp\RegistryAudit.csv" -NoTypeInformation

5. Query specific time ranges:

   $StartTime = (Get-Date).AddDays(-7)
   $EndTime = Get-Date
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4657; StartTime=$StartTime; EndTime=$EndTime}

Ensure proper audit policy configuration to capture registry modifications for security monitoring.

1. Open Local Security Policy by running secpol.msc
2. Navigate to Local Policies → Audit Policy
3. Double-click Audit object access and enable both Success and Failure
4. Configure advanced audit policy via command line:

   auditpol /set /subcategory:"Registry" /success:enable /failure:enable

5. Set up auditing on specific registry keys using PowerShell:

   $RegPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
   $Acl = Get-Acl $RegPath
   $AccessRule = New-Object System.Security.AccessControl.RegistryAuditRule("Everyone", "SetValue,CreateSubKey,Delete", "None", "None", "Success,Failure")
   $Acl.SetAuditRule($AccessRule)
   Set-Acl -Path $RegPath -AclObject $Acl

6. Verify auditing is configured:

   Get-Acl "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" | Select-Object -ExpandProperty Audit

7. Test the configuration by making a registry change and checking for Event ID 4657

Analyze Event ID 4657 entries to identify potentially malicious registry changes and security incidents.

1. Identify high-risk registry modifications by querying persistence locations:

   $SuspiciousKeys = @(
       '*\Run*',
       '*\RunOnce*',
       '*\Winlogon*',
       '*\Services*',
       '*\AppInit_DLLs*'
   )
   
   foreach ($Key in $SuspiciousKeys) {
       Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4657} | Where-Object {$_.Message -like $Key} | Select-Object TimeCreated, @{Name='User';Expression={$_.Properties[1].Value}}, @{Name='Process';Expression={$_.Properties[11].Value}}
   }

2. Cross-reference with process creation events (Event ID 4688):

   $ProcessId = "1234"  # From Event 4657
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} | Where-Object {$_.Properties[4].Value -eq $ProcessId}

3. Check for unsigned or suspicious executables making registry changes:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4657} | ForEach-Object {
       $ProcessPath = $_.Properties[11].Value
       if (Test-Path $ProcessPath) {
           $Signature = Get-AuthenticodeSignature $ProcessPath
           if ($Signature.Status -ne "Valid") {
               Write-Output "Unsigned process: $ProcessPath modified registry at $($_.TimeCreated)"
           }
       }
   }

4. Generate timeline analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4657} -MaxEvents 500 | Group-Object @{Expression={$_.Properties[11].Value}} | Sort-Object Count -Descending | Select-Object Name, Count

5. Export detailed forensic report:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4657} | Select-Object TimeCreated, @{Name='User';Expression={$_.Properties[1].Value}}, @{Name='ProcessName';Expression={$_.Properties[11].Value}}, @{Name='RegistryKey';Expression={$_.Properties[6].Value}}, @{Name='ValueName';Expression={$_.Properties[7].Value}} | Export-Csv "C:\Forensics\RegistryChanges.csv" -NoTypeInformation

Implement centralized registry audit monitoring across multiple systems using Windows Event Forwarding (WEF).

1. Configure the collector server by enabling WinRM:

   winrm quickconfig
   wecutil qc

2. Create a custom subscription for Event ID 4657:

   <?xml version="1.0" encoding="UTF-8"?>
   <Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
       <SubscriptionId>RegistryAudit</SubscriptionId>
       <SubscriptionType>SourceInitiated</SubscriptionType>
       <Description>Registry modification monitoring</Description>
       <Enabled>true</Enabled>
       <Uri>http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog</Uri>
       <ConfigurationMode>Normal</ConfigurationMode>
       <Query>
           <![CDATA[
           <QueryList>
               <Query Id="0">
                   <Select Path="Security">*[System[EventID=4657]]</Select>
               </Query>
           </QueryList>
           ]]>
       </Query>
   </Subscription>

3. Deploy the subscription:

   wecutil cs C:\Subscriptions\RegistryAudit.xml

4. Configure source computers via Group Policy or PowerShell:

   winrm set winrm/config/client @{TrustedHosts="CollectorServer"}
   wecutil ss RegistryAudit /cm:Normal

5. Monitor forwarded events on the collector:

   Get-WinEvent -LogName "ForwardedEvents" | Where-Object {$_.Id -eq 4657} | Select-Object TimeCreated, MachineName, @{Name='RegistryPath';Expression={$_.Properties[6].Value}}

6. Set up automated alerting for critical registry changes:

   Register-WmiEvent -Query "SELECT * FROM __InstanceCreationEvent WITHIN 10 WHERE TargetInstance ISA 'Win32_NTLogEvent' AND TargetInstance.EventCode = 4657" -Action {
       $Event = $Event.SourceEventArgs.NewEvent.TargetInstance
       if ($Event.Message -like '*\Run*') {
           Send-MailMessage -To "admin@company.com" -Subject "Critical Registry Change" -Body $Event.Message -SmtpServer "mail.company.com"
       }
   }