sysmon EID 12,13,14 'Incorrect field Details'

Question

What's this about?

Answer 1

I guess it's because only EID13 has a "Details" field, but EID 12 and 14 are also handled with "RegistryEvent"

<event name="SYSMONEVENT_REG_KEY" value="12" level="Informational" template="Registry object added or deleted" rulename="RegistryEvent" ruledefault="exclude" version="2">
<data name="RuleName" inType="win:UnicodeString" outType="xs:string" />
<data name="EventType" inType="win:UnicodeString" outType="xs:string" />
<data name="UtcTime" inType="win:UnicodeString" outType="xs:string" />
<data name="ProcessGuid" inType="win:GUID" />
<data name="ProcessId" inType="win:UInt32" outType="win:PID" />
<data name="Image" inType="win:UnicodeString" outType="xs:string" />
<data name="TargetObject" inType="win:UnicodeString" outType="xs:string" />
<data name="User" inType="win:UnicodeString" outType="xs:string" />
</event>
<event name="SYSMONEVENT_REG_SETVALUE" value="13" level="Informational" template="Registry value set" rulename="RegistryEvent" ruledefault="exclude" version="2">
<data name="RuleName" inType="win:UnicodeString" outType="xs:string" />
<data name="EventType" inType="win:UnicodeString" outType="xs:string" />
<data name="UtcTime" inType="win:UnicodeString" outType="xs:string" />
<data name="ProcessGuid" inType="win:GUID" />
<data name="ProcessId" inType="win:UInt32" outType="win:PID" />
<data name="Image" inType="win:UnicodeString" outType="xs:string" />
<data name="TargetObject" inType="win:UnicodeString" outType="xs:string" />
<data name="Details" inType="win:UnicodeString" outType="xs:string" />
<data name="User" inType="win:UnicodeString" outType="xs:string" />
</event>
<event name="SYSMONEVENT_REG_NAME" value="14" level="Informational" template="Registry object renamed" rulename="RegistryEvent" ruledefault="exclude" version="2">
<data name="RuleName" inType="win:UnicodeString" outType="xs:string" />
<data name="EventType" inType="win:UnicodeString" outType="xs:string" />
<data name="UtcTime" inType="win:UnicodeString" outType="xs:string" />
<data name="ProcessGuid" inType="win:GUID" />
<data name="ProcessId" inType="win:UInt32" outType="win:PID" />
<data name="Image" inType="win:UnicodeString" outType="xs:string" />
<data name="TargetObject" inType="win:UnicodeString" outType="xs:string" />
<data name="NewName" inType="win:UnicodeString" outType="xs:string" />
<data name="User" inType="win:UnicodeString" outType="xs:string" />
</event>

Answer 2

Well, it works if I remove the combination of data name "NewName" and "Details" but leave "TargetObject" and "Details"....