Registry (kernel registry ETW)

This source records successful registry changes: key creation and deletion, value set and delete, and key security changes. It resolves each change to a full key path and the process that made it.

Collector ID	freedr.registry-etw
Windows mechanism	Microsoft-Windows-Kernel-Registry manifest provider plus the classic kernel registry provider, in the shared FreeDR-Unified system logger
Hunt	events view, event_type LIKE 'registry.%'
Rule SQL source name	registry_etw
Hot table	registry_etw_v4
Code	crates/freedr-collect-registry

ETW providers

Provider	Settings	Event IDs	Use
Microsoft-Windows-Kernel-Registry {70EB4F03-C1DE-4F73-A051-33D13D5413BD}	Level 5, all keywords, provider option 0x2 (capture written value bytes)	1 CreateKey, 3 DeleteKey, 5 SetValueKey, 6 DeleteValueKey, 15 SetSecurityKey	mutations lane: evidence
same		2 OpenKey, 13 CloseKey	access lane: path tracking only
Classic registry {AE53722E-C863-11D2-8659-00C04FA321A1}	Flag 0x20000	Opcodes 14/15 (value path hints), 22/23 (KCB create/delete)	Path tracking only

Query, enumerate, flush, query-security and SetInformationKey events are not subscribed.

Event types

event_type	Stored	Fields
registry.key_created	Only when CreateKey actually created a new key (Disposition 1)	key_path
registry.key_delete	Yes	key_path
registry.value_set	Yes	key_path, value_name, value_type, value_data
registry.value_delete	Yes	key_path, value_name
registry.key_security_set	Yes	key_path

These types are reserved in code but never stored: registry.key_create_or_open_unknown, registry.key_open, registry.key_query, registry.value_query, registry.key_enumerate, registry.value_enumerate, registry.values_query_multiple, registry.key_security_query, registry.key_information_set.

Failed operations (NTSTATUS error) are not stored. Key rename, hive load/unload and previous-value capture are not available.

Columns

Column	Notes
key_path	Normalized: \REGISTRY\MACHINE becomes HKLM and \REGISTRY\USER becomes HKU. Other roots stay \REGISTRY\<root>. Up to 64 KiB.
value_name	Value set and delete only
value_type	REG_* numeric type (value set only)
value_data	The exact bytes written, only if the whole value was captured. Otherwise NULL. An empty value is an empty blob. Up to 64 KiB. Hunt searches it as hex.
actor_pid + actor_image_path, actor_command_line, actor_start_at, actor_user_sid, actor_user_name	The writing process. It is taken from the event's thread when possible, otherwise from the event header PID.

Partial: value data size

Full value capture was verified up to 2,048 bytes on one Windows 11 (22621) test. Larger values arrived only as a prefix and are stored as NULL.

Path resolution and dedupe

Stage	Behaviour
Key object map	Kernel key object to full path, built from CreateKey/OpenKey names, classic KCB create events and value hints. It holds 65,536 entries with a 10-minute TTL.
Waiting for a path	A change waits up to 2 s (8,192 pending) for its path. Changes stay in order.
Still unresolved	Dropped and counted in registry_terminal_unresolved_discarded
Duplicate merge	Identical changes (type, path, value name, type, data, actor PID) within 500 ms are merged into the first one. Limits: 65,536 entries, 32 MiB. A key close flushes pending changes.
Event ID	UUIDv5 over the event content. Duplicates are suppressed at write.

Noise controls

Rule	Counter
Events from FreeDR's own process	registry_self_callbacks_discarded
FreeDR's own keys: HKLM\SOFTWARE[\WOW6432Node]\FreeDR\…, HKLM\SYSTEM\<ControlSet>\Services\FreeDR\…	registry_freedr_key_discarded
Component store servicing: HKLM\COMPONENTS\DerivedData\Components, …\DerivedData\VersionedIndex\…\ComponentFamilies…, HKLM\COMPONENTS\CanonicalData, HKLM\COMPONENTS\ServicingStackVersions	registry_terminal_failed_or_excluded_discarded
App hives \REGISTRY\A\{GUID}\ under ActivatableClassId, Server, Interfaces, ProxyStubClsIds, Root\InventoryApplicationFile, Root\InventoryMiscellaneousUUPInfo	same
Edge Update progress values under …\Microsoft\EdgeUpdate\ClientState\<product>\CurrentState (DownloadProgressPercent, DownloadTimeRemainingMs, InstallProgressPercent, InstallTimeRemainingMs, StateValue)	same
…\Control\FeatureManagement\Policies value TemporaryEnterpriseFeatureControlState_Mirrored	same
Failed operations and unsubscribed types	same

There are no ADR-0028 measured exclusions for this source. Registry events do not trigger artifact acquisition.

COM identifier names

The console can show display names for CLSID, Interface and AppID GUIDs found in registry paths. To do this it reads the current host registration under HKLM\SOFTWARE\Classes and HKU\<sid>\Software\Classes, including WOW6432Node. This is a live lookup. Nothing is stored, and the name may differ from what was registered at event time.

Health counters

Group	Counters
Discards	registry_self_callbacks_discarded, registry_terminal_unresolved_discarded, registry_freedr_key_discarded, registry_terminal_failed_or_excluded_discarded
Merge/retention	retention_observations, retention_merged, retention_pending, retention_window_flushes, retention_capacity_flushes, retention_unresolved, …
Loss	registry_loss_raw_full, registry_loss_raw_unavailable, registry_loss_raw_malformed, registry_loss_raw_oversized, registry_loss_admission, registry_loss_controller, registry_loss_decode
Data quality	registry_value_bytes_complete, registry_value_bytes_truncated, registry_value_bytes_unavailable, registry_target_incomplete, registry_actor_uncorrelated
Rejects	registry_reject_* (unknown type/hive/view/state, empty required, invalid time, text too large)

The source also has the shared ETW decode (TDH) counters. See Storage & health.