How monitor registry value being changed from a particular key using expert rules

[cn]

Hi,

I am trying to figure out how to monitor changes to the value "start" for certain security related services.  Want to monitor this to see if someone disables the service.  I however cannot seem to see a solution in the documentation for Expert rules.  There is a MATCH "key" and a MATCH "value".  I can see examples on how to use the MATCH "key", but I do not see any kind of examples on how to use MATCH "value".  

Key/Value I want to monitor changes to:

KEY:  HKCCS\\Services\\splunkforwarder

VALUE Name:  start

This is what I created so far.  Is there a way to monitor the above?

Rule {
Process {
Include OBJECT_NAME { -v ** }
}
Target {
Match KEY {
Include OBJECT_NAME { -v "HKCCS\\Services\\splunkforwarder" }
Include -access "CREATE WRITE DELETE REPLACE_KEY RESTORE_KEY"
}
}
}

Thanks in advance!

[Daveb3d]

Wait for 10.7.  🙂