Windows Registry contains various information about users and can be viewed as a database. While Microsoft gives users customization choices, it also unintentionally turns into a tool that attackers may fully use to carry out fileless assaults, incursion persistence, and other harmful actions. The opening section of this paper introduces the registry's logical structure and internal data structures. The following section examines registry-related threats and how the current Windows 10 operating system responds to them. Finally, it shows how a system based on Windows’ integrated logging system, ETW, has been implemented. The monitoring application records and filters registry write operation data, and the filtered data is then examined and sent to VirusTotal to ascertain if the written data was malicious. This study implements an ETW-based registry attack detection system that is effective and dependable. By integrating with VirusTotal, we can more quickly and correctly identify and stop registry assaults or misuse, protecting the security of user PCs.