{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1012","id":"T1012","name":"Query Registry","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1012","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"dcfb5bb8439ec96a36facce1333f498aece8a73e78b8dec9643e9d7fcc5e15a1","description":"Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.\n\nThe Registry contains a significant amount of information about the operating system, configuration, software, and security.(Citation: Wikipedia Windows Registry) Information can easily be queried using the [Reg](https://attack.mitre.org/software/S0075) utility, though other means to access the Registry exist. Some of the information may help adversaries to further their operation within a network. Adversaries may use the information from [Query Registry](https://attack.mitre.org/techniques/T1012) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1012","external_id":"T1012"},{"source_name":"Wikipedia Windows Registry","description":"Wikipedia. (n.d.). Windows Registry. Retrieved February 2, 2015.","url":"https://en.wikipedia.org/wiki/Windows_Registry"}],"platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0063","name":"Windows Registry Key Modification","page":"telemetry/DC0063/","kind":"attack_component","category":"Endpoint activity","description":"Registry value changes or registry object renames.","collection_focus":"Use RegistryEvent 13 for value-set and 14 for rename; compare against intended policy and keep original type/value where available.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","Keep this Windows-specific source separate from other operating systems; there is no direct cross-platform event-ID equivalence."],"configuration_example":null,"required_fields":["registry_path","event_type","value_type","value"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0063","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Mode","event_type":"SetValue","value_type":"DWORD","value":1}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1012","id":"T1012","name":"Query Registry","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"source_url":"https://attack.mitre.org/techniques/T1012","technique_page":"techniques/enterprise/T1012/","page":"detections/enterprise/T1012/","status":"rule_source_available","counts":{"sigma":9,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[{"id":"ff151c33-45fa-475d-af4f-c2f93571f4fe","title":"Azure AD Health Monitoring Agent Registry Keys Access","status":"test","level":"medium","logsource":{"product":"windows","service":"security"},"data_path":"data/detection-rules/ff151c33-45fa-475d-af4f-c2f93571f4fe.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_aadhealth_mon_agent_regkey_access.yml","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC","kind":"sigma"},{"id":"1d2ab8ac-1a01-423b-9c39-001510eae8e8","title":"Azure AD Health Service Agents Registry Keys Access","status":"test","level":"medium","logsource":{"product":"windows","service":"security"},"data_path":"data/detection-rules/1d2ab8ac-1a01-423b-9c39-001510eae8e8.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_aadhealth_svc_agent_regkey_access.yml","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC","kind":"sigma"},{"id":"f8748f2c-89dc-4d95-afb0-5a2dfdbad332","title":"SAM Registry Hive Handle Request","status":"test","level":"high","logsource":{"product":"windows","service":"security"},"data_path":"data/detection-rules/f8748f2c-89dc-4d95-afb0-5a2dfdbad332.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_sam_registry_hive_handle_request.yml","author":"Roberto Rodriguez @Cyb3rWard0g","kind":"sigma"},{"id":"9a4ff3b8-6187-4fd2-8e8b-e0eae1129495","title":"SysKey Registry Keys Access","status":"test","level":"high","logsource":{"product":"windows","service":"security"},"data_path":"data/detection-rules/9a4ff3b8-6187-4fd2-8e8b-e0eae1129495.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_syskey_registry_access.yml","author":"Roberto Rodriguez @Cyb3rWard0g","kind":"sigma"},{"id":"fca949cc-79ca-446e-8064-01aa7e52ece5","title":"HackTool - PCHunter Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/fca949cc-79ca-446e-8064-01aa7e52ece5.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_pchunter.yml","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali","kind":"sigma"},{"id":"970007b7-ce32-49d0-a4a4-fbef016950bd","title":"Potential Configuration And Service Reconnaissance Via Reg.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/970007b7-ce32-49d0-a4a4-fbef016950bd.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_reg_query_registry.yml","author":"Timur Zinniatullin, oscd.community","kind":"sigma"},{"id":"82880171-b475-4201-b811-e9c826cd5eaa","title":"Exports Critical Registry Keys To a File","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/82880171-b475-4201-b811-e9c826cd5eaa.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_regedit_export_critical_keys.yml","author":"Oddvar Moe, Sander Wiebing, oscd.community","kind":"sigma"},{"id":"f0e53e89-8d22-46ea-9db5-9d4796ee2f8a","title":"Exports Registry Key To a File","status":"test","level":"low","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/f0e53e89-8d22-46ea-9db5-9d4796ee2f8a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_regedit_export_keys.yml","author":"Oddvar Moe, Sander Wiebing, oscd.community","kind":"sigma"},{"id":"a0e417e2-2fa1-40da-b6d2-e094cd5e1191","title":"Registry Enumeration via WMI Stdregprov","status":"experimental","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/a0e417e2-2fa1-40da-b6d2-e094cd5e1191.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wmic_stdregprov_reg_enumeration.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0209","name":"Detection of Registry Query for Environmental Discovery","url":"https://attack.mitre.org/detectionstrategies/DET0209","stix_id":"x-mitre-detection-strategy--106e32a9-29b7-4ec7-80cf-768662706490","relationship_id":"relationship--e4fec267-da7b-4c33-bf87-d3b2fc2b0513","description":"","analytics":[{"id":"AN0589","name":"Analytic 0589","guidance":"Registry read access associated with suspicious or non-interactive processes querying system config, installed software, or security settings.","url":"https://attack.mitre.org/detectionstrategies/DET0209#AN0589","platforms":["Windows"],"tuning":[{"field":"TargetRegistryPath","description":"Focus detection on registry hives or keys likely to reveal environment info (e.g., HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion)."},{"field":"ParentProcess","description":"May tune for suspicious parent processes such as cmd.exe, wscript.exe, or mshta.exe."},{"field":"TimeWindow","description":"Controls how closely registry access must follow process creation for correlation."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN0589","source_url":"https://attack.mitre.org/detectionstrategies/DET0209#AN0589","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0063","component":"Windows Registry Key Modification","name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","platforms":["Windows"],"analytic_id":"AN0589","source_url":"https://attack.mitre.org/detectionstrategies/DET0209#AN0589","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0063/"},{"component_id":"DC0064","component":"Command Execution","name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","platforms":["Windows"],"analytic_id":"AN0589","source_url":"https://attack.mitre.org/detectionstrategies/DET0209#AN0589","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]}]}],"telemetry_references":[{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0063","name":"Windows Registry Key Modification","tag":"Windows Registry Key Modification","page":"telemetry/DC0063/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]},{"id":"S1050","name":"PcShare","page":"tools/S1050/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0194","name":"PowerSploit","page":"tools/S0194/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0075","name":"Reg","page":"tools/S0075/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0332","name":"Remcos","page":"tools/S0332/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]},{"id":"S1050","name":"PcShare","page":"tools/S1050/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0194","name":"PowerSploit","page":"tools/S0194/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0075","name":"Reg","page":"tools/S0075/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0332","name":"Remcos","page":"tools/S0332/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0011","name":"Taidoor","url":"https://attack.mitre.org/software/S0011","kind":"malware","description":"[Taidoor](https://attack.mitre.org/software/S0011) can query the Registry on compromised hosts using <code>RegQueryValueExA</code>.(Citation: CISA MAR-10292089-1.v2 TAIDOOR August 2021)","relationship_id":"relationship--5ccac771-a984-4f06-b109-21ea7cd60b02","references":[{"source_name":"CISA MAR-10292089-1.v2 TAIDOOR August 2021","description":"CISA, FBI, DOD. (2021, August). MAR-10292089-1.v2 – Chinese Remote Access Trojan: TAIDOOR. Retrieved August 24, 2021.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-216a"}]},{"id":"S0013","name":"PlugX","url":"https://attack.mitre.org/software/S0013","kind":"malware","description":"[PlugX](https://attack.mitre.org/software/S0013) can enumerate and query for information contained within the Windows Registry.(Citation: Eset PlugX Korplug Mustang Panda March 2022)(Citation: CIRCL PlugX March 2013)(Citation: Lastline PlugX Analysis)","relationship_id":"relationship--4cb1a0d0-6276-4c2c-b299-c26c982e9e1e","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","description":"Alexandre Cote Cyr. (2022, March 23). Mustang Panda’s Hodur: Old tricks, new Korplug variant. Retrieved September 9, 2025.","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source_name":"CIRCL PlugX March 2013","description":"Computer Incident Response Center Luxembourg. (2013, March 29). Analysis of a PlugX variant. Retrieved November 5, 2018.","url":"http://circl.lu/assets/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf"},{"source_name":"Lastline PlugX Analysis","description":"Vasilenko, R. (2013, December 17). An Analysis of PlugX Malware. Retrieved November 24, 2015.","url":"https://lastline3.rssing.com/chan-29044929/all_p1.html#c29044929a2"}]},{"id":"S0021","name":"Derusbi","url":"https://attack.mitre.org/software/S0021","kind":"malware","description":"[Derusbi](https://attack.mitre.org/software/S0021) is capable of enumerating Registry keys and values.(Citation: FireEye Periscope March 2018)","relationship_id":"relationship--f023577a-e87f-4d0e-beef-575293a86153","references":[{"source_name":"FireEye Periscope March 2018","description":"FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.","url":"https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"}]},{"id":"S0022","name":"Uroburos","url":"https://attack.mitre.org/software/S0022","kind":"malware","description":"[Uroburos](https://attack.mitre.org/software/S0022) can query the Registry, typically `HKLM:\\SOFTWARE\\Classes\\.wav\\OpenWithProgIds`, to find the key and path to decrypt and load its kernel driver and kernel driver loader.(Citation: Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023)","relationship_id":"relationship--6ae983c6-b332-42d9-b489-87f475b6b9d6","references":[{"source_name":"Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023","description":"FBI et al. (2023, May 9). Hunting Russian Intelligence “Snake” Malware. Retrieved June 8, 2023.","url":"https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf"}]},{"id":"S0023","name":"CHOPSTICK","url":"https://attack.mitre.org/software/S0023","kind":"malware","description":"[CHOPSTICK](https://attack.mitre.org/software/S0023) provides access to the Windows Registry, which can be used to gather information.(Citation: FireEye APT28)","relationship_id":"relationship--f55d54fe-27ed-41f9-81db-11ccbe2d2125","references":[{"source_name":"FireEye APT28","description":"FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.","url":"https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf"}]},{"id":"S0030","name":"Carbanak","url":"https://attack.mitre.org/software/S0030","kind":"malware","description":"[Carbanak](https://attack.mitre.org/software/S0030) checks the Registry key <code>HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings</code> for proxy configurations information.(Citation: FireEye CARBANAK June 2017)","relationship_id":"relationship--3a217a5a-b6c4-47c5-822a-5b278385c811","references":[{"source_name":"FireEye CARBANAK June 2017","description":"Bennett, J., Vengerik, B. (2017, June 12). Behind the CARBANAK Backdoor. Retrieved June 11, 2018.","url":"https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html"}]},{"id":"S0031","name":"BACKSPACE","url":"https://attack.mitre.org/software/S0031","kind":"malware","description":"[BACKSPACE](https://attack.mitre.org/software/S0031) is capable of enumerating and making modifications to an infected system's Registry.(Citation: FireEye APT30)","relationship_id":"relationship--564de5da-7ecc-45c7-bbd5-619a8f316f70","references":[{"source_name":"FireEye APT30","description":"FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved November 17, 2024.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf"}]},{"id":"S0032","name":"gh0st RAT","url":"https://attack.mitre.org/software/S0032","kind":"malware","description":"[gh0st RAT](https://attack.mitre.org/software/S0032) has checked for the existence of a Service key to determine if it has already been installed on the system.(Citation: Gh0stRAT ATT March 2019)","relationship_id":"relationship--80d8e746-f0a0-4781-824a-0147dbbee072","references":[{"source_name":"Gh0stRAT ATT March 2019","description":"Quinn, J. (2019, March 25). The odd case of a Gh0stRAT variant. Retrieved July 15, 2020.","url":"https://cybersecurity.att.com/blogs/labs-research/the-odd-case-of-a-gh0strat-variant"}]},{"id":"S0045","name":"ADVSTORESHELL","url":"https://attack.mitre.org/software/S0045","kind":"malware","description":"[ADVSTORESHELL](https://attack.mitre.org/software/S0045) can enumerate registry keys.(Citation: ESET Sednit Part 2)(Citation: Bitdefender APT28 Dec 2015)","relationship_id":"relationship--9f496c45-eac5-464f-858b-ef481f2f37ff","references":[{"source_name":"ESET Sednit Part 2","description":"ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.","url":"http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf"},{"source_name":"Bitdefender APT28 Dec 2015","description":"Bitdefender. (2015, December). APT28 Under the Scope. Retrieved February 23, 2017.","url":"https://download.bitdefender.com/resources/media/materials/white-papers/en/Bitdefender_In-depth_analysis_of_APT28%E2%80%93The_Political_Cyber-Espionage.pdf"}]},{"id":"S0075","name":"Reg","url":"https://attack.mitre.org/software/S0075","kind":"tool","description":"[Reg](https://attack.mitre.org/software/S0075) may be used to gather details from the Windows Registry of a local or remote system at the command-line interface.(Citation: Microsoft Reg)","relationship_id":"relationship--5365d764-76fa-49ce-b76b-d0344322b037","references":[{"source_name":"Microsoft Reg","description":"Microsoft. (2012, April 17). Reg. Retrieved May 1, 2015.","url":"https://technet.microsoft.com/en-us/library/cc732643.aspx"}]},{"id":"S0091","name":"Epic","url":"https://attack.mitre.org/software/S0091","kind":"malware","description":"[Epic](https://attack.mitre.org/software/S0091) uses the <code>rem reg query</code> command to obtain values from Registry keys.(Citation: Kaspersky Turla)","relationship_id":"relationship--014010a2-7bb8-4b11-bef9-c85609b2d94b","references":[{"source_name":"Kaspersky Turla","description":"Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.","url":"https://securelist.com/the-epic-turla-operation/65545/"}]},{"id":"S0115","name":"Crimson","url":"https://attack.mitre.org/software/S0115","kind":"malware","description":"[Crimson](https://attack.mitre.org/software/S0115) can check the Registry for the presence of <code>HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\last_edate</code> to determine how long it has been installed on a host.(Citation: Proofpoint Operation Transparent Tribe March 2016)","relationship_id":"relationship--e1caf917-c15f-4388-8ca0-6cdefd01da8f","references":[{"source_name":"Proofpoint Operation Transparent Tribe March 2016","description":"Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"}]},{"id":"S0126","name":"ComRAT","url":"https://attack.mitre.org/software/S0126","kind":"malware","description":"[ComRAT](https://attack.mitre.org/software/S0126) can check the default browser by querying <code>HKCR\\http\\shell\\open\\command</code>.(Citation: ESET ComRAT May 2020)","relationship_id":"relationship--b511900a-9bfe-4f8c-b1e2-b95669a5eaeb","references":[{"source_name":"ESET ComRAT May 2020","description":"Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"}]},{"id":"S0140","name":"Shamoon","url":"https://attack.mitre.org/software/S0140","kind":"malware","description":"[Shamoon](https://attack.mitre.org/software/S0140) queries several Registry keys to identify hard disk partitions to overwrite.(Citation: Palo Alto Shamoon Nov 2016)","relationship_id":"relationship--2dfbcf5d-8563-440c-bd9c-0cfc15059bd5","references":[{"source_name":"Palo Alto Shamoon Nov 2016","description":"Falcone, R.. (2016, November 30). Shamoon 2: Return of the Disttrack Wiper. Retrieved January 11, 2017.","url":"http://researchcenter.paloaltonetworks.com/2016/11/unit42-shamoon-2-return-disttrack-wiper/"}]},{"id":"S0145","name":"POWERSOURCE","url":"https://attack.mitre.org/software/S0145","kind":"malware","description":"[POWERSOURCE](https://attack.mitre.org/software/S0145) queries Registry keys in preparation for setting Run keys to achieve persistence.(Citation: Cisco DNSMessenger March 2017)","relationship_id":"relationship--9c79076c-341f-4eb3-bed7-300723747b18","references":[{"source_name":"Cisco DNSMessenger March 2017","description":"Brumaghin, E. and Grady, C.. (2017, March 2). Covert Channels and Poor Decisions: The Tale of DNSMessenger. Retrieved March 8, 2017.","url":"http://blog.talosintelligence.com/2017/03/dnsmessenger.html"}]},{"id":"S0154","name":"Cobalt Strike","url":"https://attack.mitre.org/software/S0154","kind":"malware","description":"[Cobalt Strike](https://attack.mitre.org/software/S0154) can query <code>HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\<Excel Version>\\Excel\\Security\\AccessVBOM\\</code>  to determine if the security setting for restricting default programmatic access is enabled.(Citation: Talos Cobalt Strike September 2020)(Citation: Cobalt Strike Manual 4.3 November 2020)","relationship_id":"relationship--8e12d3f8-6c2b-4622-889e-63c9abcff04b","references":[{"source_name":"Talos Cobalt Strike September 2020","description":"Mavis, N. (2020, September 21). The Art and Science of Detecting Cobalt Strike. Retrieved September 12, 2024.","url":"https://web.archive.org/web/20210219195905/https://talos-intelligence-site.s3.amazonaws.com/production/document_files/files/000/095/031/original/Talos_Cobalt_Strike.pdf"},{"source_name":"Cobalt Strike Manual 4.3 November 2020","description":"Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021.","url":"https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf"}]},{"id":"S0155","name":"WINDSHIELD","url":"https://attack.mitre.org/software/S0155","kind":"malware","description":"[WINDSHIELD](https://attack.mitre.org/software/S0155) can gather Registry values.(Citation: FireEye APT32 May 2017)","relationship_id":"relationship--47f611f4-b9f0-42ef-9629-ee4a56e737ed","references":[{"source_name":"FireEye APT32 May 2017","description":"Carr, N.. (2017, May 14). Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations. Retrieved June 18, 2017.","url":"https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"}]},{"id":"S0165","name":"OSInfo","url":"https://attack.mitre.org/software/S0165","kind":"malware","description":"[OSInfo](https://attack.mitre.org/software/S0165) queries the registry to look for information about Terminal Services.(Citation: Symantec Buckeye)","relationship_id":"relationship--60198640-1e5a-4b8e-9a69-5f275f7e0e68","references":[{"source_name":"Symantec Buckeye","description":"Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.","url":"https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"}]},{"id":"S0172","name":"Reaver","url":"https://attack.mitre.org/software/S0172","kind":"malware","description":"[Reaver](https://attack.mitre.org/software/S0172) queries the Registry to determine the correct Startup path to use for persistence.(Citation: Palo Alto Reaver Nov 2017)","relationship_id":"relationship--f44478f1-fdd7-4e84-8b96-60e6c6a10683","references":[{"source_name":"Palo Alto Reaver Nov 2017","description":"Grunzweig, J. and Miller-Osborn, J. (2017, November 10). New Malware with Ties to SunOrcal Discovered. Retrieved November 16, 2017.","url":"https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"}]},{"id":"S0180","name":"Volgmer","url":"https://attack.mitre.org/software/S0180","kind":"malware","description":"[Volgmer](https://attack.mitre.org/software/S0180) checks the system for certain Registry keys.(Citation: US-CERT Volgmer 2 Nov 2017)","relationship_id":"relationship--2a945fce-862b-46ff-8ee5-b78b220803f3","references":[{"source_name":"US-CERT Volgmer 2 Nov 2017","description":"US-CERT. (2017, November 01). Malware Analysis Report (MAR) - 10135536-D. Retrieved July 16, 2018.","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-D_WHITE_S508C.PDF"}]},{"id":"S0182","name":"FinFisher","url":"https://attack.mitre.org/software/S0182","kind":"malware","description":"[FinFisher](https://attack.mitre.org/software/S0182) queries Registry values as part of its anti-sandbox checks.(Citation: FinFisher Citation)(Citation: Microsoft FinFisher March 2018)","relationship_id":"relationship--79cebb53-3154-4512-9343-2942b1f72ff5","references":[{"source_name":"Microsoft FinFisher March 2018","description":"Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.","url":"https://cloudblogs.microsoft.com/microsoftsecure/2018/03/01/finfisher-exposed-a-researchers-tale-of-defeating-traps-tricks-and-complex-virtual-machines/"},{"source_name":"FinFisher Citation","description":"FinFisher. (n.d.). Retrieved September 12, 2024.","url":"https://web.archive.org/web/20171222050934/http://www.finfisher.com/FinFisher/index.html"}]},{"id":"S0184","name":"POWRUNER","url":"https://attack.mitre.org/software/S0184","kind":"malware","description":"[POWRUNER](https://attack.mitre.org/software/S0184) may query the Registry by running <code>reg query</code> on a victim.(Citation: FireEye APT34 Dec 2017)","relationship_id":"relationship--d078f862-c090-4e79-808b-ff69887a920c","references":[{"source_name":"FireEye APT34 Dec 2017","description":"Sardiwal, M, et al. (2017, December 7). New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit. Retrieved December 20, 2017.","url":"https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"}]},{"id":"S0186","name":"DownPaper","url":"https://attack.mitre.org/software/S0186","kind":"malware","description":"[DownPaper](https://attack.mitre.org/software/S0186) searches and reads the value of the Windows Update Registry Run key.(Citation: ClearSky Charming Kitten Dec 2017)","relationship_id":"relationship--521146dd-185d-4a8c-a3b4-b3caedbc7a14","references":[{"source_name":"ClearSky Charming Kitten Dec 2017","description":"ClearSky Cyber Security. (2017, December). Charming Kitten. Retrieved December 27, 2017.","url":"http://www.clearskysec.com/wp-content/uploads/2017/12/Charming_Kitten_2017.pdf"}]},{"id":"S0194","name":"PowerSploit","url":"https://attack.mitre.org/software/S0194","kind":"tool","description":"[PowerSploit](https://attack.mitre.org/software/S0194) contains a collection of Privesc-PowerUp modules that can query Registry keys for potential opportunities.(Citation: GitHub PowerSploit May 2012)(Citation: PowerSploit Documentation)","relationship_id":"relationship--312c929a-abf6-44c1-95d6-6dde60c7a3fe","references":[{"source_name":"GitHub PowerSploit May 2012","description":"PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.","url":"https://github.com/PowerShellMafia/PowerSploit"},{"source_name":"PowerSploit Documentation","description":"PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.","url":"http://powersploit.readthedocs.io"}]},{"id":"S0201","name":"JPIN","url":"https://attack.mitre.org/software/S0201","kind":"malware","description":"[JPIN](https://attack.mitre.org/software/S0201) can enumerate Registry keys.(Citation: Microsoft PLATINUM April 2016)","relationship_id":"relationship--3c786b4b-b146-4511-b3ca-65fe7c3521e8","references":[{"source_name":"Microsoft PLATINUM April 2016","description":"Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.","url":"https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf"}]},{"id":"S0203","name":"Hydraq","url":"https://attack.mitre.org/software/S0203","kind":"malware","description":"[Hydraq](https://attack.mitre.org/software/S0203) creates a backdoor through which remote attackers can retrieve system information, such as CPU speed, from Registry keys.(Citation: Symantec Trojan.Hydraq Jan 2010)(Citation: Symantec Hydraq Jan 2010)","relationship_id":"relationship--0825b101-deff-45cf-867c-af3ccb233744","references":[{"source_name":"Symantec Trojan.Hydraq Jan 2010","description":"Symantec Security Response. (2010, January 18). The Trojan.Hydraq Incident. Retrieved February 20, 2018.","url":"https://www.symantec.com/connect/blogs/trojanhydraq-incident"},{"source_name":"Symantec Hydraq Jan 2010","description":"Lelli, A. (2010, January 11). Trojan.Hydraq. Retrieved February 20, 2018.","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2010-011114-1830-99"}]},{"id":"S0238","name":"Proxysvc","url":"https://attack.mitre.org/software/S0238","kind":"malware","description":"[Proxysvc](https://attack.mitre.org/software/S0238) gathers product names from the Registry key: <code>HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion ProductName</code> and the processor description from the Registry key <code>HKLM\\HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0 ProcessorNameString</code>.(Citation: McAfee GhostSecret)","relationship_id":"relationship--c8bf1e63-1275-46c7-b378-b4a3cc3eb369","references":[{"source_name":"McAfee GhostSecret","description":"Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}]},{"id":"S0239","name":"Bankshot","url":"https://attack.mitre.org/software/S0239","kind":"malware","description":"[Bankshot](https://attack.mitre.org/software/S0239) searches for certain Registry keys to be configured before executing the payload.(Citation: US-CERT Bankshot Dec 2017)","relationship_id":"relationship--77d079b6-2df9-4ae9-bc7c-1ebe99708660","references":[{"source_name":"US-CERT Bankshot Dec 2017","description":"US-CERT. (2017, December 13). Malware Analysis Report (MAR) - 10135536-B. Retrieved July 17, 2018.","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-B_WHITE.PDF"}]},{"id":"S0240","name":"ROKRAT","url":"https://attack.mitre.org/software/S0240","kind":"malware","description":"[ROKRAT](https://attack.mitre.org/software/S0240) can access the <code>HKLM\\System\\CurrentControlSet\\Services\\mssmbios\\Data\\SMBiosData</code> Registry key to obtain the System manufacturer value to identify the machine type.(Citation: Talos Group123)","relationship_id":"relationship--2de4d7df-18fc-4202-93ee-2fcfe6f2e501","references":[{"source_name":"Talos Group123","description":"Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.","url":"https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html"}]},{"id":"S0241","name":"RATANKBA","url":"https://attack.mitre.org/software/S0241","kind":"malware","description":"[RATANKBA](https://attack.mitre.org/software/S0241) uses the command <code>reg query “HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\InternetSettings”</code>.(Citation: RATANKBA)","relationship_id":"relationship--bca618ac-7867-4dc4-b683-ae3f61addc68","references":[{"source_name":"RATANKBA","description":"Trend Micro. (2017, February 27). RATANKBA: Delving into Large-scale Watering Holes against Enterprises. Retrieved May 22, 2018.","url":"https://www.trendmicro.com/en_us/research/17/b/ratankba-watering-holes-against-enterprises.html"}]},{"id":"S0242","name":"SynAck","url":"https://attack.mitre.org/software/S0242","kind":"malware","description":"[SynAck](https://attack.mitre.org/software/S0242) enumerates Registry keys associated with event logs.(Citation: SecureList SynAck Doppelgänging May 2018)","relationship_id":"relationship--69c3aaaf-0922-4662-a8b3-026dc5ea0aae","references":[{"source_name":"SecureList SynAck Doppelgänging May 2018","description":"Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.","url":"https://securelist.com/synack-targeted-ransomware-uses-the-doppelganging-technique/85431/"}]},{"id":"S0249","name":"Gold Dragon","url":"https://attack.mitre.org/software/S0249","kind":"malware","description":"[Gold Dragon](https://attack.mitre.org/software/S0249) enumerates registry keys with the command <code>regkeyenum</code> and obtains information for the Registry key <code>HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run</code>.(Citation: McAfee Gold Dragon)","relationship_id":"relationship--f8705660-10d1-4eca-80c6-f2884cdecb36","references":[{"source_name":"McAfee Gold Dragon","description":"Sherstobitoff, R., Saavedra-Morales, J. (2018, February 02). Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems. Retrieved June 6, 2018.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"}]},{"id":"S0251","name":"Zebrocy","url":"https://attack.mitre.org/software/S0251","kind":"malware","description":"[Zebrocy](https://attack.mitre.org/software/S0251) executes the <code>reg query</code> command to obtain information in the Registry.(Citation: ESET Zebrocy May 2019)","relationship_id":"relationship--c4e03a2f-3617-4017-8dab-8904b1060c87","references":[{"source_name":"ESET Zebrocy May 2019","description":"ESET Research. (2019, May 22). A journey to Zebrocy land. Retrieved June 20, 2019.","url":"https://www.welivesecurity.com/2019/05/22/journey-zebrocy-land/"}]},{"id":"S0252","name":"Brave Prince","url":"https://attack.mitre.org/software/S0252","kind":"malware","description":"[Brave Prince](https://attack.mitre.org/software/S0252) gathers information about the Registry.(Citation: McAfee Gold Dragon)","relationship_id":"relationship--ab08048c-4d1f-4214-9f53-1e87f6a20988","references":[{"source_name":"McAfee Gold Dragon","description":"Sherstobitoff, R., Saavedra-Morales, J. (2018, February 02). Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems. Retrieved June 6, 2018.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"}]},{"id":"S0260","name":"InvisiMole","url":"https://attack.mitre.org/software/S0260","kind":"malware","description":"[InvisiMole](https://attack.mitre.org/software/S0260) can enumerate Registry values, keys, and data.(Citation: ESET InvisiMole June 2018)","relationship_id":"relationship--fdb02bf4-a950-4ae7-b07c-a3ed0322ef6e","references":[{"source_name":"ESET InvisiMole June 2018","description":"Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018.","url":"https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"}]},{"id":"S0267","name":"FELIXROOT","url":"https://attack.mitre.org/software/S0267","kind":"malware","description":"[FELIXROOT](https://attack.mitre.org/software/S0267) queries the Registry for specific keys for potential privilege escalation and proxy information. [FELIXROOT](https://attack.mitre.org/software/S0267) has also used WMI to query the Windows Registry.(Citation: FireEye FELIXROOT July 2018)(Citation: ESET GreyEnergy Oct 2018)","relationship_id":"relationship--4f5c53df-7076-4580-bd45-c4c9201269ae","references":[{"source_name":"ESET GreyEnergy Oct 2018","description":"Cherepanov, A. (2018, October). GREYENERGY A successor to BlackEnergy. Retrieved November 15, 2018.","url":"https://www.welivesecurity.com/wp-content/uploads/2018/10/ESET_GreyEnergy.pdf"},{"source_name":"FireEye FELIXROOT July 2018","description":"Patil, S. (2018, June 26). Microsoft Office Vulnerabilities Used to Distribute FELIXROOT Backdoor in Recent Campaign. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20200607025424/https://www.fireeye.com/blog/threat-research/2018/07/microsoft-office-vulnerabilities-used-to-distribute-felixroot-backdoor.html"}]},{"id":"S0268","name":"Bisonal","url":"https://attack.mitre.org/software/S0268","kind":"malware","description":"[Bisonal](https://attack.mitre.org/software/S0268) has used the RegQueryValueExA function to retrieve proxy information in the Registry.(Citation: Talos Bisonal Mar 2020)","relationship_id":"relationship--a455cf4b-2402-4b72-a5e8-e5f5ed6d2bfc","references":[{"source_name":"Talos Bisonal Mar 2020","description":"Mercer, W., et al. (2020, March 5). Bisonal: 10 years of play. Retrieved January 26, 2022.","url":"https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"}]},{"id":"S0269","name":"QUADAGENT","url":"https://attack.mitre.org/software/S0269","kind":"malware","description":"[QUADAGENT](https://attack.mitre.org/software/S0269) checks if a value exists within a Registry key in the HKCU hive whose name is the same as the scheduled task it has created.(Citation: Unit 42 QUADAGENT July 2018)","relationship_id":"relationship--c2e58b40-7644-4c0c-92ac-b63a565aca44","references":[{"source_name":"Unit 42 QUADAGENT July 2018","description":"Lee, B., Falcone, R. (2018, July 25). OilRig Targets Technology Service Provider and Government Agency with QUADAGENT. Retrieved August 9, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/"}]},{"id":"S0330","name":"Zeus Panda","url":"https://attack.mitre.org/software/S0330","kind":"malware","description":"[Zeus Panda](https://attack.mitre.org/software/S0330) checks for the existence of a Registry key and if it contains certain values.(Citation: GDATA Zeus Panda June 2017)","relationship_id":"relationship--d18d7fab-1f10-4b83-83e1-a288ec4db2bd","references":[{"source_name":"GDATA Zeus Panda June 2017","description":"Ebach, L. (2017, June 22). Analysis Results of Zeus.Variant.Panda. Retrieved November 5, 2018.","url":"https://cyberwtf.files.wordpress.com/2017/07/panda-whitepaper.pdf"}]},{"id":"S0332","name":"Remcos","url":"https://attack.mitre.org/software/S0332","kind":"tool","description":"[Remcos](https://attack.mitre.org/software/S0332) can obtain Registry data from targeted systems.(Citation: Fortinet Remcos Campaign NOV 2024)","relationship_id":"relationship--c844b416-6de4-4fd5-9255-91c1783cad2a","references":[{"source_name":"Fortinet Remcos Campaign NOV 2024","description":"Zhang, X. (2024, November 8). New Campaign Uses Remcos RAT to Exploit Victims. Retrieved April 16, 2026.","url":"https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims"}]},{"id":"S0335","name":"Carbon","url":"https://attack.mitre.org/software/S0335","kind":"malware","description":"[Carbon](https://attack.mitre.org/software/S0335) enumerates values in the Registry.(Citation: ESET Carbon Mar 2017)","relationship_id":"relationship--3598d32e-306d-421d-af3c-8c9f5d1628a2","references":[{"source_name":"ESET Carbon Mar 2017","description":"ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.","url":"https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/"}]},{"id":"S0344","name":"Azorult","url":"https://attack.mitre.org/software/S0344","kind":"malware","description":"[Azorult](https://attack.mitre.org/software/S0344) can check for installed software on the system under the Registry key <code>Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall</code>.(Citation: Unit42 Azorult Nov 2018)","relationship_id":"relationship--26fcd59e-5758-47ec-8a5e-68150d1ff805","references":[{"source_name":"Unit42 Azorult Nov 2018","description":"Yan, T., et al. (2018, November 21). New Wine in Old Bottle: New Azorult Variant Found in FindMyName Campaign using Fallout Exploit Kit. Retrieved November 29, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/11/unit42-new-wine-old-bottle-new-azorult-variant-found-findmyname-campaign-using-fallout-exploit-kit/"}]},{"id":"S0348","name":"Cardinal RAT","url":"https://attack.mitre.org/software/S0348","kind":"malware","description":"[Cardinal RAT](https://attack.mitre.org/software/S0348) contains watchdog functionality that periodically ensures <code>HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Load</code> is set to point to its executable.(Citation: PaloAlto CardinalRat Apr 2017)","relationship_id":"relationship--8875e27f-9f8d-418b-8937-a2c4d1858607","references":[{"source_name":"PaloAlto CardinalRat Apr 2017","description":"Grunzweig, J.. (2017, April 20). Cardinal RAT Active for Over Two Years. Retrieved December 8, 2018.","url":"https://researchcenter.paloaltonetworks.com/2017/04/unit42-cardinal-rat-active-two-years/"}]},{"id":"S0354","name":"Denis","url":"https://attack.mitre.org/software/S0354","kind":"malware","description":"[Denis](https://attack.mitre.org/software/S0354) queries the Registry for keys and values.(Citation: Cybereason Cobalt Kitty 2017)","relationship_id":"relationship--31028cf4-870e-490e-871e-ec55814dcef8","references":[{"source_name":"Cybereason Cobalt Kitty 2017","description":"Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"id":"S0376","name":"HOPLIGHT","url":"https://attack.mitre.org/software/S0376","kind":"malware","description":"A variant of [HOPLIGHT](https://attack.mitre.org/software/S0376) hooks lsass.exe, and lsass.exe then checks the Registry for the data value 'rdpproto' under the key <code>SYSTEM\\CurrentControlSet\\Control\\Lsa Name</code>.(Citation: US-CERT HOPLIGHT Apr 2019)","relationship_id":"relationship--1c548d89-557e-4c48-9b71-8a761d94e77b","references":[{"source_name":"US-CERT HOPLIGHT Apr 2019","description":"US-CERT. (2019, April 10). MAR-10135536-8 – North Korean Trojan: HOPLIGHT. Retrieved April 19, 2019.","url":"https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"}]},{"id":"S0380","name":"StoneDrill","url":"https://attack.mitre.org/software/S0380","kind":"malware","description":"[StoneDrill](https://attack.mitre.org/software/S0380) has looked in the registry to find the default browser path.(Citation: Kaspersky StoneDrill 2017)","relationship_id":"relationship--b7316e86-545b-4397-9b1f-d05a8ea64f4f","references":[{"source_name":"Kaspersky StoneDrill 2017","description":"Kaspersky Lab. (2017, March 7). From Shamoon to StoneDrill: Wipers attacking Saudi organizations and beyond. Retrieved March 14, 2019.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180722/Report_Shamoon_StoneDrill_final.pdf"}]},{"id":"S0385","name":"njRAT","url":"https://attack.mitre.org/software/S0385","kind":"malware","description":"[njRAT](https://attack.mitre.org/software/S0385) can read specific registry values.(Citation: Trend Micro njRAT 2018)","relationship_id":"relationship--2bc482f0-f5ee-433c-81bd-566ef8a8d7a6","references":[{"source_name":"Trend Micro njRAT 2018","description":"Pascual, C. (2018, November 27). AutoIt-Compiled Worm Affecting Removable Media Delivers Fileless Version of BLADABINDI/njRAT Backdoor. Retrieved June 4, 2019.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/autoit-compiled-worm-affecting-removable-media-delivers-fileless-version-of-bladabindi-njrat-backdoor/"}]},{"id":"S0386","name":"Ursnif","url":"https://attack.mitre.org/software/S0386","kind":"malware","description":"[Ursnif](https://attack.mitre.org/software/S0386) has used [Reg](https://attack.mitre.org/software/S0075) to query the Registry for installed programs.(Citation: TrendMicro Ursnif Mar 2015)(Citation: TrendMicro BKDR_URSNIF.SM)","relationship_id":"relationship--a16da3e1-c81e-4565-a78f-607cb937010b","references":[{"source_name":"TrendMicro Ursnif Mar 2015","description":"Caragay, R. (2015, March 26). URSNIF: The Multifaceted Malware. Retrieved June 5, 2019.","url":"https://web.archive.org/web/20210719165945/https://www.trendmicro.com/en_us/research/15/c/ursnif-the-multifaceted-malware.html?_ga=2.165628854.808042651.1508120821-744063452.1505819992"},{"source_name":"TrendMicro BKDR_URSNIF.SM","description":"Sioting, S. (2013, June 15). BKDR_URSNIF.SM. Retrieved June 5, 2019.","url":"https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/BKDR_URSNIF.SM?_ga=2.129468940.1462021705.1559742358-1202584019.1549394279"}]},{"id":"S0412","name":"ZxShell","url":"https://attack.mitre.org/software/S0412","kind":"malware","description":"[ZxShell](https://attack.mitre.org/software/S0412) can query the netsvc group value data located in the svchost group Registry key.(Citation: Talos ZxShell Oct 2014) ","relationship_id":"relationship--5acaf47e-4608-4548-81e8-368a2687844e","references":[{"source_name":"Talos ZxShell Oct 2014","description":"Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.","url":"https://blogs.cisco.com/security/talos/opening-zxshell"}]},{"id":"S0414","name":"BabyShark","url":"https://attack.mitre.org/software/S0414","kind":"malware","description":"[BabyShark](https://attack.mitre.org/software/S0414) has executed the <code>reg query</code> command for <code>HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Default</code>.(Citation: Unit42 BabyShark Feb 2019)\t","relationship_id":"relationship--2f28f6e0-795f-4e0d-8459-514a42a96ce9","references":[{"source_name":"Unit42 BabyShark Feb 2019","description":"Unit 42. (2019, February 22). New BabyShark Malware Targets U.S. National Security Think Tanks. Retrieved October 7, 2019.","url":"https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/"}]},{"id":"S0438","name":"Attor","url":"https://attack.mitre.org/software/S0438","kind":"malware","description":"[Attor](https://attack.mitre.org/software/S0438) has opened the registry and performed query searches.(Citation: ESET Attor Oct 2019)","relationship_id":"relationship--fc661e81-fc5e-4243-874e-f311bc5a2d8d","references":[{"source_name":"ESET Attor Oct 2019","description":"Hromcova, Z. (2019, October). AT COMMANDS, TOR-BASED COMMUNICATIONS: MEET ATTOR, A FANTASY CREATURE AND ALSO A SPY PLATFORM. Retrieved May 6, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf"}]},{"id":"S0448","name":"Rising Sun","url":"https://attack.mitre.org/software/S0448","kind":"malware","description":"[Rising Sun](https://attack.mitre.org/software/S0448) has identified the OS product name from a compromised host by searching the registry for `SOFTWARE\\MICROSOFT\\Windows NT\\ CurrentVersion | ProductName`.(Citation: McAfee Sharpshooter December 2018)","relationship_id":"relationship--dac3df5a-9569-41ac-94d2-115062b7b632","references":[{"source_name":"McAfee Sharpshooter December 2018","description":"Sherstobitoff, R., Malhotra, A., et. al.. (2018, December 18). Operation Sharpshooter Campaign Targets Global Defense, Critical Infrastructure. Retrieved May 14, 2020.","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf"}]},{"id":"S0476","name":"Valak","url":"https://attack.mitre.org/software/S0476","kind":"malware","description":"[Valak](https://attack.mitre.org/software/S0476) can use the Registry for code updates and to collect credentials.(Citation: Unit 42 Valak July 2020)","relationship_id":"relationship--b0d3ef27-8854-486f-942b-f0cd42c8a85c","references":[{"source_name":"Unit 42 Valak July 2020","description":"Duncan, B. (2020, July 24). Evolution of Valak, from Its Beginnings to Mass Distribution. Retrieved August 31, 2020.","url":"https://unit42.paloaltonetworks.com/valak-evolution/"}]},{"id":"S0484","name":"Carberp","url":"https://attack.mitre.org/software/S0484","kind":"malware","description":"[Carberp](https://attack.mitre.org/software/S0484) has searched the Image File Execution Options registry key for \"Debugger\" within every subkey.(Citation: Prevx Carberp March 2011)","relationship_id":"relationship--8de816a1-c89b-47ea-9456-c3bc139e6885","references":[{"source_name":"Prevx Carberp March 2011","description":"Giuliani, M., Allievi, A. (2011, February 28). Carberp - a modular information stealing trojan. Retrieved September 12, 2024.","url":"https://web.archive.org/web/20231227000328/http://pxnow.prevx.com/content/blog/carberp-a_modular_information_stealing_trojan.pdf"}]},{"id":"S0496","name":"REvil","url":"https://attack.mitre.org/software/S0496","kind":"malware","description":"[REvil](https://attack.mitre.org/software/S0496) can query the Registry to get random file extensions to append to encrypted files.(Citation: Secureworks REvil September 2019)","relationship_id":"relationship--3a50e0b3-fe35-4cfe-bdd6-306946b15abc","references":[{"source_name":"Secureworks REvil September 2019","description":"Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020.","url":"https://www.secureworks.com/research/revil-sodinokibi-ransomware"}]},{"id":"S0512","name":"FatDuke","url":"https://attack.mitre.org/software/S0512","kind":"malware","description":"[FatDuke](https://attack.mitre.org/software/S0512) can get user agent strings for the default browser from <code>HKCU\\Software\\Classes\\http\\shell\\open\\command</code>.(Citation: ESET Dukes October 2019)","relationship_id":"relationship--052c54bf-b92b-4a7e-bca4-bc884437a327","references":[{"source_name":"ESET Dukes October 2019","description":"Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"}]},{"id":"S0513","name":"LiteDuke","url":"https://attack.mitre.org/software/S0513","kind":"malware","description":"[LiteDuke](https://attack.mitre.org/software/S0513) can query the Registry to check for the presence of <code>HKCU\\Software\\KasperskyLab</code>.(Citation: ESET Dukes October 2019)","relationship_id":"relationship--59c92aeb-1e62-4e60-8ead-63100e068c0d","references":[{"source_name":"ESET Dukes October 2019","description":"Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"}]},{"id":"S0517","name":"Pillowmint","url":"https://attack.mitre.org/software/S0517","kind":"malware","description":"[Pillowmint](https://attack.mitre.org/software/S0517) has used shellcode which reads code stored in the registry keys <code>\\REGISTRY\\SOFTWARE\\Microsoft\\DRM</code> using the native Windows API as well as read <code>HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces</code> as part of its C2.(Citation: Trustwave Pillowmint June 2020)\t","relationship_id":"relationship--3454bb10-fad3-48b6-b20a-81cb45e7bbc1","references":[{"source_name":"Trustwave Pillowmint June 2020","description":"Trustwave SpiderLabs. (2020, June 22). Pillowmint: FIN7’s Monkey Thief . Retrieved July 27, 2020.","url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/pillowmint-fin7s-monkey-thief/"}]},{"id":"S0532","name":"Lucifer","url":"https://attack.mitre.org/software/S0532","kind":"malware","description":"[Lucifer](https://attack.mitre.org/software/S0532) can check for existing stratum cryptomining information in <code>HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\spreadCpuXmr – %stratum info%</code>.(Citation: Unit 42 Lucifer June 2020)","relationship_id":"relationship--f8c754dd-a4a8-4507-bce2-c738e5354a3c","references":[{"source_name":"Unit 42 Lucifer June 2020","description":"Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.","url":"https://unit42.paloaltonetworks.com/lucifer-new-cryptojacking-and-ddos-hybrid-malware/"}]},{"id":"S0534","name":"Bazar","url":"https://attack.mitre.org/software/S0534","kind":"malware","description":"[Bazar](https://attack.mitre.org/software/S0534) can query <code>Windows\\CurrentVersion\\Uninstall</code> for installed applications.(Citation: Cybereason Bazar July 2020)(Citation: NCC Group Team9 June 2020)","relationship_id":"relationship--75a3cfad-a9e7-453f-88b8-787304575a33","references":[{"source_name":"Cybereason Bazar July 2020","description":"Cybereason Nocturnus. (2020, July 16). A BAZAR OF TRICKS: FOLLOWING TEAM9’S DEVELOPMENT CYCLES. Retrieved November 18, 2020.","url":"https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles"},{"source_name":"NCC Group Team9 June 2020","description":"Pantazopoulos, N. (2020, June 2). In-depth analysis of the new Team9 malware family. Retrieved December 1, 2020.","url":"https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/"}]},{"id":"S0559","name":"SUNBURST","url":"https://attack.mitre.org/software/S0559","kind":"malware","description":"[SUNBURST](https://attack.mitre.org/software/S0559) collected the registry value <code>HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\MachineGuid</code> from compromised hosts.(Citation: FireEye SUNBURST Backdoor December 2020)","relationship_id":"relationship--cedfb953-2088-4e8d-a21b-57fdfce65337","references":[{"source_name":"FireEye SUNBURST Backdoor December 2020","description":"FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021.","url":"https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"}]},{"id":"S0560","name":"TEARDROP","url":"https://attack.mitre.org/software/S0560","kind":"malware","description":"[TEARDROP](https://attack.mitre.org/software/S0560) checked that <code>HKU\\SOFTWARE\\Microsoft\\CTF</code> existed before decoding its embedded payload.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: Microsoft Deep Dive Solorigate January 2021) ","relationship_id":"relationship--184739bd-f45e-4f2b-8caf-19e2cb30ae92","references":[{"source_name":"FireEye SUNBURST Backdoor December 2020","description":"FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021.","url":"https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"},{"source_name":"Microsoft Deep Dive Solorigate January 2021","description":"MSTIC, CDOC, 365 Defender Research Team. (2021, January 20). Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop . Retrieved January 22, 2021.","url":"https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/"}]},{"id":"S0567","name":"Dtrack","url":"https://attack.mitre.org/software/S0567","kind":"malware","description":"[Dtrack](https://attack.mitre.org/software/S0567) can collect the RegisteredOwner, RegisteredOrganization, and InstallDate registry values.(Citation: CyberBit Dtrack)","relationship_id":"relationship--6b55412a-760f-4ff8-b48a-6ff3bed8b0e9","references":[{"source_name":"CyberBit Dtrack","description":"Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.","url":"https://www.cyberbit.com/blog/endpoint-security/dtrack-apt-malware-found-in-nuclear-power-plant/"}]},{"id":"S0570","name":"BitPaymer","url":"https://attack.mitre.org/software/S0570","kind":"malware","description":"[BitPaymer](https://attack.mitre.org/software/S0570) can use the RegEnumKeyW to iterate through Registry keys.(Citation: Crowdstrike Indrik November 2018) ","relationship_id":"relationship--7d71658b-2b9f-4639-9fe7-7c7924b52ff7","references":[{"source_name":"Crowdstrike Indrik November 2018","description":"Frankoff, S., Hartley, B. (2018, November 14). Big Game Hunting: The Evolution of INDRIK SPIDER From Dridex Wire Fraud to BitPaymer Targeted Ransomware. Retrieved January 6, 2021.","url":"https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/"}]},{"id":"S0574","name":"BendyBear","url":"https://attack.mitre.org/software/S0574","kind":"malware","description":"[BendyBear](https://attack.mitre.org/software/S0574) can query the host's Registry key at <code>HKEY_CURRENT_USER\\Console\\QuickEdit</code> to retrieve data.(Citation: Unit42 BendyBear Feb 2021)","relationship_id":"relationship--9753bc87-1ed3-4a28-a9d3-80e004d83e62","references":[{"source_name":"Unit42 BendyBear Feb 2021","description":"Harbison, M. (2021, February 9). BendyBear: Novel Chinese Shellcode Linked With Cyber Espionage Group BlackTech. Retrieved February 16, 2021.","url":"https://unit42.paloaltonetworks.com/bendybear-shellcode-blacktech/"}]},{"id":"S0579","name":"Waterbear","url":"https://attack.mitre.org/software/S0579","kind":"malware","description":"[Waterbear](https://attack.mitre.org/software/S0579) can query the Registry key <code>\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MSDTC\\MTxOCI\"</code> to see if the value `OracleOcilib` exists.(Citation: Trend Micro Waterbear December 2019)","relationship_id":"relationship--93741cce-12ce-4cc0-9fa6-5db7d8a1309a","references":[{"source_name":"Trend Micro Waterbear December 2019","description":"Su, V. et al. (2019, December 11). Waterbear Returns, Uses API Hooking to Evade Security. Retrieved February 22, 2021.","url":"https://www.trendmicro.com/en_us/research/19/l/waterbear-is-back-uses-api-hooking-to-evade-security-product-detection.html"}]},{"id":"S0589","name":"Sibot","url":"https://attack.mitre.org/software/S0589","kind":"malware","description":"[Sibot](https://attack.mitre.org/software/S0589) has queried the registry for proxy server information.(Citation: MSTIC NOBELIUM Mar 2021)","relationship_id":"relationship--03070395-3b76-4351-a3bd-0d9eaaa6652c","references":[{"source_name":"MSTIC NOBELIUM Mar 2021","description":"Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.","url":"https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/"}]},{"id":"S0603","name":"Stuxnet","url":"https://attack.mitre.org/software/S0603","kind":"malware","description":"[Stuxnet](https://attack.mitre.org/software/S0603) searches the Registry for indicators of security programs.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)","relationship_id":"relationship--c88502ec-f0f7-4b86-865b-8dc0a21b9580","references":[{"source_name":"Nicolas Falliere, Liam O Murchu, Eric Chien February 2011","description":"Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.","url":"https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"}]},{"id":"S0604","name":"Industroyer","url":"https://attack.mitre.org/software/S0604","kind":"malware","description":"[Industroyer](https://attack.mitre.org/software/S0604) has a data wiper component that enumerates keys in the Registry <code>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services</code>.(Citation: ESET Industroyer)","relationship_id":"relationship--f6c9d3c4-2e47-4881-a376-e60791092fc5","references":[{"source_name":"ESET Industroyer","description":"Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"}]},{"id":"S0612","name":"WastedLocker","url":"https://attack.mitre.org/software/S0612","kind":"malware","description":"[WastedLocker](https://attack.mitre.org/software/S0612) checks for specific registry keys related to the <code>UCOMIEnumConnections</code> and <code>IActiveScriptParseProcedure32</code> interfaces.(Citation: NCC Group WastedLocker June 2020)","relationship_id":"relationship--9677d051-2bac-4686-8611-2d089d3d4b58","references":[{"source_name":"NCC Group WastedLocker June 2020","description":"Antenucci, S., Pantazopoulos, N., Sandee, M. (2020, June 23). WastedLocker: A New Ransomware Variant Developed By The Evil Corp Group. Retrieved September 14, 2021.","url":"https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/"}]},{"id":"S0627","name":"SodaMaster","url":"https://attack.mitre.org/software/S0627","kind":"malware","description":"[SodaMaster](https://attack.mitre.org/software/S0627) has the ability to query the Registry to detect a key specific to VMware.(Citation: Securelist APT10 March 2021)","relationship_id":"relationship--e9a4e4bd-717a-4048-a623-4a1758b93acd","references":[{"source_name":"Securelist APT10 March 2021","description":"GREAT. (2021, March 30). APT10: sophisticated multi-layered loader Ecipekac discovered in A41APT campaign. Retrieved June 17, 2021.","url":"https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/"}]},{"id":"S0660","name":"Clambling","url":"https://attack.mitre.org/software/S0660","kind":"malware","description":"[Clambling](https://attack.mitre.org/software/S0660) has the ability to enumerate Registry keys, including <code>KEY_CURRENT_USER\\Software\\Bitcoin\\Bitcoin-Qt\\strDataDir</code> to search for a bitcoin wallet.(Citation: Trend Micro DRBControl February 2020)(Citation: Talent-Jump Clambling February 2020)","relationship_id":"relationship--27f4a7f3-7086-471d-8826-7bc544069c44","references":[{"source_name":"Talent-Jump Clambling February 2020","description":"Chen, T. and Chen, Z. (2020, February 17). CLAMBLING - A New Backdoor Base On Dropbox. Retrieved November 12, 2021.","url":"https://www.talent-jump.com/article/2020/02/17/CLAMBLING-A-New-Backdoor-Base-On-Dropbox-en/"},{"source_name":"Trend Micro DRBControl February 2020","description":"Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}]},{"id":"S0666","name":"Gelsemium","url":"https://attack.mitre.org/software/S0666","kind":"malware","description":"[Gelsemium](https://attack.mitre.org/software/S0666) can open random files and Registry keys to obscure malware behavior from sandbox analysis.(Citation: ESET Gelsemium June 2021)","relationship_id":"relationship--c6a7e9fe-cdf3-451a-b97f-788b5839606c","references":[{"source_name":"ESET Gelsemium June 2021","description":"Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.","url":"https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"}]},{"id":"S0668","name":"TinyTurla","url":"https://attack.mitre.org/software/S0668","kind":"malware","description":"[TinyTurla](https://attack.mitre.org/software/S0668) can query the Registry for its configuration information.(Citation: Talos TinyTurla September 2021)","relationship_id":"relationship--b33486bc-c7f4-46d7-9e20-3863c5508820","references":[{"source_name":"Talos TinyTurla September 2021","description":"Cisco Talos. (2021, September 21). TinyTurla - Turla deploys new malware to keep a secret backdoor on victim machines. Retrieved December 2, 2021.","url":"https://blog.talosintelligence.com/2021/09/tinyturla.html"}]},{"id":"S0673","name":"DarkWatchman","url":"https://attack.mitre.org/software/S0673","kind":"malware","description":"[DarkWatchman](https://attack.mitre.org/software/S0673) can query the Registry to determine if it has already been installed on the system.(Citation: Prevailion DarkWatchman 2021)","relationship_id":"relationship--794caee4-34cd-493f-a047-1f4a8b4c8de8","references":[{"source_name":"Prevailion DarkWatchman 2021","description":"Smith, S., Stafford, M. (2021, December 14). DarkWatchman: A new evolution in fileless techniques. Retrieved January 10, 2022.","url":"https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/"}]},{"id":"S0674","name":"CharmPower","url":"https://attack.mitre.org/software/S0674","kind":"malware","description":"[CharmPower](https://attack.mitre.org/software/S0674) has the ability to enumerate `Uninstall` registry values.(Citation: Check Point APT35 CharmPower January 2022)","relationship_id":"relationship--f1183695-42c7-4d17-81b3-18d3fdd8822a","references":[{"source_name":"Check Point APT35 CharmPower January 2022","description":"Check Point. (2022, January 11). APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit. Retrieved January 24, 2022.","url":"https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/"}]},{"id":"S0680","name":"LitePower","url":"https://attack.mitre.org/software/S0680","kind":"malware","description":"[LitePower](https://attack.mitre.org/software/S0680) can query the Registry for keys added to execute COM hijacking.(Citation: Kaspersky WIRTE November 2021)","relationship_id":"relationship--3b035642-31cc-498e-9dff-9e145b35b968","references":[{"source_name":"Kaspersky WIRTE November 2021","description":"Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.","url":"https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044"}]},{"id":"S0692","name":"SILENTTRINITY","url":"https://attack.mitre.org/software/S0692","kind":"tool","description":"[SILENTTRINITY](https://attack.mitre.org/software/S0692) can use the `GetRegValue` function to check Registry keys within `HKCU\\Software\\Policies\\Microsoft\\Windows\\Installer\\AlwaysInstallElevated` and `HKLM\\Software\\Policies\\Microsoft\\Windows\\Installer\\AlwaysInstallElevated`. It also contains additional modules that can check software AutoRun values and use the Win32 namespace to get values from HKCU, HKLM, HKCR, and HKCC hives.(Citation: GitHub SILENTTRINITY Modules July 2019)","relationship_id":"relationship--75a89128-fcdd-4bcf-98a7-9f0ea162a794","references":[{"source_name":"GitHub SILENTTRINITY Modules July 2019","description":"Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022.","url":"https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo"}]},{"id":"S1013","name":"ZxxZ","url":"https://attack.mitre.org/software/S1013","kind":"malware","description":"[ZxxZ](https://attack.mitre.org/software/S1013) can search the registry of a compromised host.(Citation: Cisco Talos Bitter Bangladesh May 2022)","relationship_id":"relationship--4e5de254-8dd4-46cd-a8af-8cdfd335e5f1","references":[{"source_name":"Cisco Talos Bitter Bangladesh May 2022","description":"Raghuprasad, C . (2022, May 11). Bitter APT adds Bangladesh to their targets. Retrieved June 1, 2022.","url":"https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html"}]},{"id":"S1015","name":"Milan","url":"https://attack.mitre.org/software/S1015","kind":"malware","description":"[Milan](https://attack.mitre.org/software/S1015) can query `HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography MachineGuid` to retrieve the machine GUID.(Citation: Accenture Lyceum Targets November 2021)","relationship_id":"relationship--732a3283-d7ae-4d09-8446-edbd28c38ec0","references":[{"source_name":"Accenture Lyceum Targets November 2021","description":"Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022.","url":"https://www.accenture.com/us-en/blogs/cyber-defense/iran-based-lyceum-campaigns"}]},{"id":"S1018","name":"Saint Bot","url":"https://attack.mitre.org/software/S1018","kind":"malware","description":"[Saint Bot](https://attack.mitre.org/software/S1018) has used `check_registry_keys` as part of its environmental checks.(Citation: Malwarebytes Saint Bot April 2021)","relationship_id":"relationship--5da42f91-d58e-48bd-b8b2-3d35db7edcf2","references":[{"source_name":"Malwarebytes Saint Bot April 2021","description":"Hasherezade. (2021, April 6). A deep dive into Saint Bot, a new downloader. Retrieved June 9, 2022.","url":"https://blog.malwarebytes.com/threat-intelligence/2021/04/a-deep-dive-into-saint-bot-downloader/"}]},{"id":"S1019","name":"Shark","url":"https://attack.mitre.org/software/S1019","kind":"malware","description":"[Shark](https://attack.mitre.org/software/S1019) can query `HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography MachineGuid` to retrieve the machine GUID.(Citation: Accenture Lyceum Targets November 2021)","relationship_id":"relationship--1d7661c8-82cf-481c-89e4-927eedaffc22","references":[{"source_name":"Accenture Lyceum Targets November 2021","description":"Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022.","url":"https://www.accenture.com/us-en/blogs/cyber-defense/iran-based-lyceum-campaigns"}]},{"id":"S1039","name":"Bumblebee","url":"https://attack.mitre.org/software/S1039","kind":"malware","description":"[Bumblebee](https://attack.mitre.org/software/S1039) can check the Registry for specific keys.(Citation: Medium Ali Salem Bumblebee April 2022)","relationship_id":"relationship--acbf0f3f-5dd4-42ad-9399-047b8ff5dc0a","references":[{"source_name":"Medium Ali Salem Bumblebee April 2022","description":"Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022.","url":"https://elis531989.medium.com/the-chronicles-of-bumblebee-the-hook-the-bee-and-the-trickbot-connection-686379311056"}]},{"id":"S1044","name":"FunnyDream","url":"https://attack.mitre.org/software/S1044","kind":"malware","description":"[FunnyDream](https://attack.mitre.org/software/S1044) can check `Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings` to extract the `ProxyServer` string.(Citation: Bitdefender FunnyDream Campaign November 2020)","relationship_id":"relationship--8db65d27-ddf4-4edd-9ccb-8112a78e9f47","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","description":"Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}]},{"id":"S1047","name":"Mori","url":"https://attack.mitre.org/software/S1047","kind":"malware","description":"[Mori](https://attack.mitre.org/software/S1047) can read data from the Registry including from `HKLM\\Software\\NFC\\IPA` and\n`HKLM\\Software\\NFC\\`.(Citation: DHS CISA AA22-055A MuddyWater February 2022)","relationship_id":"relationship--9bab0784-d593-4fbc-8f03-0f2340184beb","references":[{"source_name":"DHS CISA AA22-055A MuddyWater February 2022","description":"FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.","url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"}]},{"id":"S1050","name":"PcShare","url":"https://attack.mitre.org/software/S1050","kind":"tool","description":"[PcShare](https://attack.mitre.org/software/S1050) can search the registry files of a compromised host.(Citation: Bitdefender FunnyDream Campaign November 2020)","relationship_id":"relationship--9fedbd2e-93d1-4693-8365-f25ae4374e6a","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","description":"Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}]},{"id":"S1060","name":"Mafalda","url":"https://attack.mitre.org/software/S1060","kind":"malware","description":"[Mafalda](https://attack.mitre.org/software/S1060) can enumerate Registry keys with all subkeys and values.(Citation: SentinelLabs Metador Technical Appendix Sept 2022)","relationship_id":"relationship--7ad999fd-9d57-40d3-b942-d8749a6f46cc","references":[{"source_name":"SentinelLabs Metador Technical Appendix Sept 2022","description":"SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.","url":"https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm"}]},{"id":"S1064","name":"SVCReady","url":"https://attack.mitre.org/software/S1064","kind":"malware","description":"[SVCReady](https://attack.mitre.org/software/S1064) can search for the `HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System` Registry key to gather system information.(Citation: HP SVCReady Jun 2022)","relationship_id":"relationship--10514be7-2dcb-4e70-a579-e1e1e6c2d900","references":[{"source_name":"HP SVCReady Jun 2022","description":"Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.","url":"https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/"}]},{"id":"S1065","name":"Woody RAT","url":"https://attack.mitre.org/software/S1065","kind":"malware","description":"[Woody RAT](https://attack.mitre.org/software/S1065) can search registry keys to identify antivirus programs on an compromised host.(Citation: MalwareBytes WoodyRAT Aug 2022)","relationship_id":"relationship--e611b2ca-ecb4-47f4-acc2-614d37926d5b","references":[{"source_name":"MalwareBytes WoodyRAT Aug 2022","description":"MalwareBytes Threat Intelligence Team. (2022, August 3). Woody RAT: A new feature-rich malware spotted in the wild. Retrieved December 6, 2022.","url":"https://www.malwarebytes.com/blog/threat-intelligence/2022/08/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild"}]},{"id":"S1076","name":"QUIETCANARY","url":"https://attack.mitre.org/software/S1076","kind":"malware","description":"[QUIETCANARY](https://attack.mitre.org/software/S1076) has the ability to retrieve information from the Registry.(Citation: Mandiant Suspected Turla Campaign February 2023)","relationship_id":"relationship--e8805949-55f7-47cd-965c-2edd4221da12","references":[{"source_name":"Mandiant Suspected Turla Campaign February 2023","description":"Hawley, S. et al. (2023, February 2). Turla: A Galaxy of Opportunity. Retrieved May 15, 2023.","url":"https://www.mandiant.com/resources/blog/turla-galaxy-opportunity"}]},{"id":"S1099","name":"Samurai","url":"https://attack.mitre.org/software/S1099","kind":"malware","description":"[Samurai](https://attack.mitre.org/software/S1099) can query `SOFTWARE\\Microsoft\\.NETFramework\\policy\\v2.0` for discovery.(Citation: Kaspersky ToddyCat June 2022)","relationship_id":"relationship--c4179f06-f1e8-432c-81db-c88b3a37f0bc","references":[{"source_name":"Kaspersky ToddyCat June 2022","description":"Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.","url":"https://securelist.com/toddycat/106799/"}]},{"id":"S1148","name":"Raccoon Stealer","url":"https://attack.mitre.org/software/S1148","kind":"malware","description":"[Raccoon Stealer](https://attack.mitre.org/software/S1148) queries the Windows Registry to fingerprint the infected host via the `HKLM:\\SOFTWARE\\Microsoft\\Cryptography\\MachineGuid` key.(Citation: Sekoia Raccoon1 2022)(Citation: Sekoia Raccoon2 2022)","relationship_id":"relationship--bbdcf7d5-4a03-4654-b719-8c3456db9a12","references":[{"source_name":"Sekoia Raccoon2 2022","description":"Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.","url":"https://blog.sekoia.io/raccoon-stealer-v2-part-2-in-depth-analysis/"},{"source_name":"Sekoia Raccoon1 2022","description":"Quentin Bourgue, Pierre le Bourhis, & Sekoia TDR. (2022, June 28). Raccoon Stealer v2 - Part 1: The return of the dead. Retrieved August 1, 2024.","url":"https://blog.sekoia.io/raccoon-stealer-v2-part-1-the-return-of-the-dead/"}]},{"id":"S1159","name":"DUSTTRAP","url":"https://attack.mitre.org/software/S1159","kind":"malware","description":"[DUSTTRAP](https://attack.mitre.org/software/S1159) can enumerate Registry items.(Citation: Google Cloud APT41 2024)","relationship_id":"relationship--018a5e33-ef18-4a6b-8389-c950053d4a75","references":[{"source_name":"Google Cloud APT41 2024","description":"Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust"}]},{"id":"S1180","name":"BlackByte Ransomware","url":"https://attack.mitre.org/software/S1180","kind":"malware","description":"[BlackByte Ransomware](https://attack.mitre.org/software/S1180) enumerates the Registry, specifically the `HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options` key.(Citation: Trustwave BlackByte 2021)","relationship_id":"relationship--2133b98d-891c-4602-8c01-4fc93b807980","references":[{"source_name":"Trustwave BlackByte 2021","description":"Rodel Mendrez & Lloyd Macrohon. (2021, October 15). BlackByte Ransomware – Pt. 1 In-depth Analysis. Retrieved December 16, 2024.","url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/blackbyte-ransomware-pt-1-in-depth-analysis/"}]},{"id":"S1190","name":"Kapeka","url":"https://attack.mitre.org/software/S1190","kind":"malware","description":"[Kapeka](https://attack.mitre.org/software/S1190) queries registry values for stored configuration information.(Citation: WithSecure Kapeka 2024)","relationship_id":"relationship--9d12ae29-b183-49c1-8171-52322f7971df","references":[{"source_name":"WithSecure Kapeka 2024","description":"Mohammad Kazem Hassan Nejad, WithSecure. (2024, April 17). KAPEKA A novel backdoor spotted in Eastern Europe. Retrieved January 6, 2025.","url":"https://labs.withsecure.com/content/dam/labs/docs/WithSecure-Research-Kapeka.pdf"}]},{"id":"S1201","name":"TRANSLATEXT","url":"https://attack.mitre.org/software/S1201","kind":"malware","description":"[TRANSLATEXT](https://attack.mitre.org/software/S1201) has queried the following registry key to check for installed Chrome extensions: ` HKCU\\Software\\Policies\\Google\\Chrome\\ExtensionInstallForcelist `.(Citation: Zscaler Kimsuky TRANSLATEXT) ","relationship_id":"relationship--bfe610a9-83be-47b4-8928-c5a33007ddb6","references":[{"source_name":"Zscaler Kimsuky TRANSLATEXT","description":"Park, S. (2024, June 27). Kimsuky deploys TRANSLATEXT to target South Korean academia. Retrieved October 14, 2024.","url":"https://www.zscaler.com/blogs/security-research/kimsuky-deploys-translatext-target-south-korean-academia#technical-analysis"}]},{"id":"S1228","name":"PUBLOAD","url":"https://attack.mitre.org/software/S1228","kind":"malware","description":"[PUBLOAD](https://attack.mitre.org/software/S1228) has queried Registry values to identify software using `reg query`.(Citation: Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024)","relationship_id":"relationship--c174f9d0-513c-440a-8a99-65eb68b494bb","references":[{"source_name":"Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024","description":"Lenart Bermejo, Sunny Lu, Ted Lee. (2024, September 9). Earth Preta Evolves its Attacks with New Malware and Strategies. Retrieved August 4, 2025.","url":"https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html"}]},{"id":"S1240","name":"RedLine Stealer","url":"https://attack.mitre.org/software/S1240","kind":"malware","description":"[RedLine Stealer](https://attack.mitre.org/software/S1240) can query the Windows Registry.(Citation: McAfee RedLine Stealer April 2024)","relationship_id":"relationship--39b63ba5-41dc-4b47-9858-97abdda827cd","references":[{"source_name":"McAfee RedLine Stealer April 2024","description":"Mohansundaram M, Neil Tyagi. (2024, April 17). Redline Stealer: A Novel Approach. Retrieved September 17, 2025.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/redline-stealer-a-novel-approach/"}]},{"id":"S1242","name":"Qilin","url":"https://attack.mitre.org/software/S1242","kind":"malware","description":"[Qilin](https://attack.mitre.org/software/S1242) can check `HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control SystemStartOptions` to determine if a machine is running in safe mode.(Citation: Trend Micro Agenda Ransomware AUG 2022)","relationship_id":"relationship--798d8217-a605-450c-9634-2297adcd227e","references":[{"source_name":"Trend Micro Agenda Ransomware AUG 2022","description":"Magdy, S. et al. (2022, August 25). New Golang Ransomware Agenda Customizes Attacks. Retrieved September 26, 2025.","url":"https://www.trendmicro.com/en_us/research/22/h/new-golang-ransomware-agenda-customizes-attacks.html"}]}],"actors":[{"id":"G0010","name":"Turla","url":"https://attack.mitre.org/groups/G0010","kind":"intrusion-set","description":"[Turla](https://attack.mitre.org/groups/G0010) surveys a system upon check-in to discover information in the Windows Registry with the <code>reg query</code> command.(Citation: Kaspersky Turla) [Turla](https://attack.mitre.org/groups/G0010) has also retrieved PowerShell payloads hidden in Registry keys as well as checking keys associated with null session named pipes .(Citation: ESET Turla PowerShell May 2019)","relationship_id":"relationship--519c4c7f-8495-4b8a-b58e-551a78e469cc","references":[{"source_name":"Kaspersky Turla","description":"Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.","url":"https://securelist.com/the-epic-turla-operation/65545/"},{"source_name":"ESET Turla PowerShell May 2019","description":"Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019.","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"}]},{"id":"G0027","name":"Threat Group-3390","url":"https://attack.mitre.org/groups/G0027","kind":"intrusion-set","description":"A [Threat Group-3390](https://attack.mitre.org/groups/G0027) tool can read and decrypt stored Registry values.(Citation: Nccgroup Emissary Panda May 2018)","relationship_id":"relationship--3559da63-5706-4e5a-b130-89858c2c0f44","references":[{"source_name":"Nccgroup Emissary Panda May 2018","description":"Pantazopoulos, N., Henry T. (2018, May 18). Emissary Panda – A potential new malicious tool. Retrieved June 25, 2018.","url":"https://research.nccgroup.com/2018/05/18/emissary-panda-a-potential-new-malicious-tool/"}]},{"id":"G0030","name":"Lotus Blossom","url":"https://attack.mitre.org/groups/G0030","kind":"intrusion-set","description":"[Lotus Blossom](https://attack.mitre.org/groups/G0030) has run commands such as `reg query HKLM\\SYSTEM\\CurrentControlSet\\Services\\[service name]\\Parameters` to verify if installed implants are running as a service.(Citation: Cisco LotusBlossom 2025)","relationship_id":"relationship--feef4e0f-c65b-42ed-9fdf-e5fe38a6adaa","references":[{"source_name":"Cisco LotusBlossom 2025","description":"Joey Chen, Cisco Talos. (2025, February 27). Lotus Blossom espionage group targets multiple industries with different versions of Sagerunex and hacking tools. Retrieved March 15, 2025.","url":"https://blog.talosintelligence.com/lotus-blossom-espionage-group/"}]},{"id":"G0032","name":"Lazarus Group","url":"https://attack.mitre.org/groups/G0032","kind":"intrusion-set","description":"[Lazarus Group](https://attack.mitre.org/groups/G0032) malware IndiaIndia checks Registry keys within HKCU and HKLM to determine if certain applications are present, including SecureCRT, Terminal Services, RealVNC, TightVNC, UltraVNC, Radmin, mRemote, TeamViewer, FileZilla, pcAnyware, and Remote Desktop. Another [Lazarus Group](https://attack.mitre.org/groups/G0032) malware sample checks for the presence of the following Registry key:<code>HKEY_CURRENT_USER\\Software\\Bitcoin\\Bitcoin-Qt</code>.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Loaders)(Citation: McAfee Lazarus Resurfaces Feb 2018)","relationship_id":"relationship--39b735d3-c659-4d1a-8e7e-082c0f049c2d","references":[{"source_name":"Novetta Blockbuster Loaders","description":"Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Loaders, Installers and Uninstallers Report. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source_name":"Novetta Blockbuster","description":"Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source_name":"McAfee Lazarus Resurfaces Feb 2018","description":"Sherstobitoff, R. (2018, February 12). Lazarus Resurfaces, Targets Global Banks and Bitcoin Users. Retrieved February 19, 2018.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"}]},{"id":"G0035","name":"Dragonfly","url":"https://attack.mitre.org/groups/G0035","kind":"intrusion-set","description":"[Dragonfly](https://attack.mitre.org/groups/G0035) has queried the Registry to identify victim information.(Citation: US-CERT TA18-074A)","relationship_id":"relationship--4d5240d1-508f-4cf0-bf38-9f9276894cbf","references":[{"source_name":"US-CERT TA18-074A","description":"US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"id":"G0038","name":"Stealth Falcon","url":"https://attack.mitre.org/groups/G0038","kind":"intrusion-set","description":"[Stealth Falcon](https://attack.mitre.org/groups/G0038) malware attempts to determine the installed version of .NET by querying the Registry.(Citation: Citizen Lab Stealth Falcon May 2016)","relationship_id":"relationship--746b0def-62c8-438d-b5ec-aa6b7dbfb860","references":[{"source_name":"Citizen Lab Stealth Falcon May 2016","description":"Marczak, B. and Scott-Railton, J.. (2016, May 29). Keep Calm and (Don’t) Enable Macros: A New Threat Actor Targets UAE Dissidents. Retrieved June 8, 2016.","url":"https://citizenlab.org/2016/05/stealth-falcon/"}]},{"id":"G0047","name":"Gamaredon Group","url":"https://attack.mitre.org/groups/G0047","kind":"intrusion-set","description":"[Gamaredon Group](https://attack.mitre.org/groups/G0047) has queried ` HKEY_CURRENT_USER\\\\Console\\\\WindowsUpdates` to obtain the C2 addresses.(Citation: SymantecCarbonBlack_ShuckwormUSB_Apr2025) ","relationship_id":"relationship--749a620d-a87e-45b7-a9f6-8fa926320c59","references":[{"source_name":"SymantecCarbonBlack_ShuckwormUSB_Apr2025","description":"Threat Hunter Team, Symantec and Carbon Black. (2025, April 10). Shuckworm Targets Foreign Military Mission Based in Ukraine. Retrieved July 23, 2025.","url":"https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"}]},{"id":"G0049","name":"OilRig","url":"https://attack.mitre.org/groups/G0049","kind":"intrusion-set","description":"[OilRig](https://attack.mitre.org/groups/G0049) has used <code>reg query “HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Default”</code> on a victim to query the Registry.(Citation: Palo Alto OilRig May 2016)","relationship_id":"relationship--e30c24d3-d440-4395-88b3-3192a02c4364","references":[{"source_name":"Palo Alto OilRig May 2016","description":"Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017.","url":"http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/"}]},{"id":"G0050","name":"APT32","url":"https://attack.mitre.org/groups/G0050","kind":"intrusion-set","description":"[APT32](https://attack.mitre.org/groups/G0050)'s backdoor can query the Windows Registry to gather system information. (Citation: ESET OceanLotus Mar 2019)","relationship_id":"relationship--46144407-0f14-4358-8d4e-23b3ef13cb4e","references":[{"source_name":"ESET OceanLotus Mar 2019","description":"Dumont, R. (2019, March 20). Fake or Fake: Keeping up with OceanLotus decoys. Retrieved April 1, 2019.","url":"https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"}]},{"id":"G0082","name":"APT38","url":"https://attack.mitre.org/groups/G0082","kind":"intrusion-set","description":"[APT38](https://attack.mitre.org/groups/G0082) has run node.js malware to query the Registry to discover installed software.(Citation: MIcrosoft Mastra npm Compromise JUN 2026)","relationship_id":"relationship--5dc5e7d5-8d4d-450c-826d-7719de39ab28","references":[{"source_name":"MIcrosoft Mastra npm Compromise JUN 2026","description":"Microsoft Threat Intelligence. (2026, June 17). From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet. Retrieved September 30, 2026.","url":"https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/"}]},{"id":"G0087","name":"APT39","url":"https://attack.mitre.org/groups/G0087","kind":"intrusion-set","description":"[APT39](https://attack.mitre.org/groups/G0087) has used various strains of malware to query the Registry.(Citation: FBI FLASH APT39 September 2020)","relationship_id":"relationship--c3cef083-71f7-46ed-85c1-0b44ac24b85e","references":[{"source_name":"FBI FLASH APT39 September 2020","description":"FBI. (2020, September 17). Indicators of Compromise Associated with Rana Intelligence Computing, also known as Advanced Persistent Threat 39, Chafer, Cadelspy, Remexi, and ITG07. Retrieved December 10, 2020.","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"}]},{"id":"G0094","name":"Kimsuky","url":"https://attack.mitre.org/groups/G0094","kind":"intrusion-set","description":"[Kimsuky](https://attack.mitre.org/groups/G0094) has obtained specific Registry keys and values on a compromised host.(Citation: Talos Kimsuky Nov 2021)","relationship_id":"relationship--62784c03-0ee3-4a53-ba0e-876db5ede08a","references":[{"source_name":"Talos Kimsuky Nov 2021","description":"An, J and Malhotra, A. (2021, November 10). North Korean attackers use malicious blogs to deliver malware to high-profile South Korean targets. Retrieved December 29, 2021.","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"}]},{"id":"G0096","name":"APT41","url":"https://attack.mitre.org/groups/G0096","kind":"intrusion-set","description":"[APT41](https://attack.mitre.org/groups/G0096) queried registry values to determine items such as configured RDP ports and network configurations.(Citation: Rostovcev APT41 2021)","relationship_id":"relationship--d4e65cc4-3cd3-4d0e-b3b5-09fd12c659bf","references":[{"source_name":"Rostovcev APT41 2021","description":"Nikita Rostovcev. (2022, August 18). APT41 World Tour 2021 on a tight schedule. Retrieved February 22, 2024.","url":"https://www.group-ib.com/blog/apt41-world-tour-2021/"}]},{"id":"G0114","name":"Chimera","url":"https://attack.mitre.org/groups/G0114","kind":"intrusion-set","description":"[Chimera](https://attack.mitre.org/groups/G0114) has queried Registry keys using <code>reg query \\\\<host>\\HKU\\<SID>\\SOFTWARE\\Microsoft\\Terminal Server Client\\Servers</code> and <code>reg query \\\\<host>\\HKU\\<SID>\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings</code>.(Citation: NCC Group Chimera January 2021)","relationship_id":"relationship--c495478b-6bae-4d1e-a43e-be07fe7cdb48","references":[{"source_name":"NCC Group Chimera January 2021","description":"Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024.","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"id":"G0117","name":"Fox Kitten","url":"https://attack.mitre.org/groups/G0117","kind":"intrusion-set","description":"[Fox Kitten](https://attack.mitre.org/groups/G0117) has accessed Registry hives ntuser.dat and UserClass.dat.(Citation: CISA AA20-259A Iran-Based Actor September 2020)","relationship_id":"relationship--b8b16140-82bc-42a0-82f7-bfc402f4b4a4","references":[{"source_name":"CISA AA20-259A Iran-Based Actor September 2020","description":"CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}]},{"id":"G0119","name":"Indrik Spider","url":"https://attack.mitre.org/groups/G0119","kind":"intrusion-set","description":"[Indrik Spider](https://attack.mitre.org/groups/G0119) has used a service account to extract copies of the `Security` Registry hive.(Citation: Mandiant_UNC2165)","relationship_id":"relationship--e56386ab-5c44-403a-bfaf-dce6c6129c0c","references":[{"source_name":"Mandiant_UNC2165","description":"Mandiant Intelligence. (2022, June 2). To HADES and Back: UNC2165 Shifts to LOCKBIT to Evade Sanctions. Retrieved July 29, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc2165-shifts-to-evade-sanctions/"}]},{"id":"G0128","name":"ZIRCONIUM","url":"https://attack.mitre.org/groups/G0128","kind":"intrusion-set","description":"[ZIRCONIUM](https://attack.mitre.org/groups/G0128) has used a tool to query the Registry for proxy settings.(Citation: Zscaler APT31 Covid-19 October 2020)","relationship_id":"relationship--1558f550-390d-4c40-a2f7-c9aa1fcf9f1b","references":[{"source_name":"Zscaler APT31 Covid-19 October 2020","description":"Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.","url":"https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online"}]},{"id":"G1017","name":"Volt Typhoon","url":"https://attack.mitre.org/groups/G1017","kind":"intrusion-set","description":"[Volt Typhoon](https://attack.mitre.org/groups/G1017) has queried the Registry on compromised systems, `reg query hklm\\software\\`, for information on installed software including PuTTY.(Citation: Joint Cybersecurity Advisory Volt Typhoon June 2023)(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)","relationship_id":"relationship--de4a0c7c-2a21-4038-8466-7f933be35d95","references":[{"source_name":"CISA AA24-038A PRC Critical Infrastructure February 2024","description":"CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"},{"source_name":"Joint Cybersecurity Advisory Volt Typhoon June 2023","description":"NSA et al. (2023, May 24). People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection. Retrieved July 27, 2023.","url":"https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"}]},{"id":"G1034","name":"Daggerfly","url":"https://attack.mitre.org/groups/G1034","kind":"intrusion-set","description":"[Daggerfly](https://attack.mitre.org/groups/G1034) used [Reg](https://attack.mitre.org/software/S0075) to dump the Security Account Manager (SAM), System, and Security Windows registry hives from victim machines.(Citation: Symantec Daggerfly 2023)","relationship_id":"relationship--da139c4d-ee2f-4d07-9d0b-fb60bdf0353c","references":[{"source_name":"Symantec Daggerfly 2023","description":"Threat Hunter Team. (2023, April 20). Daggerfly: APT Actor Targets Telecoms Company in Africa. Retrieved July 25, 2024.","url":"https://symantec-enterprise-blogs.security.com/threat-intelligence/apt-attacks-telecoms-africa-mgbot"}]},{"id":"G1043","name":"BlackByte","url":"https://attack.mitre.org/groups/G1043","kind":"intrusion-set","description":"[BlackByte](https://attack.mitre.org/groups/G1043) queried registry values to determine system language settings.(Citation: Picus BlackByte 2022)","relationship_id":"relationship--9a1da7be-9aaf-495a-bd56-f196f26b6240","references":[{"source_name":"Picus BlackByte 2022","description":"Huseyin Can Yuceel. (2022, February 21). TTPs used by BlackByte Ransomware Targeting Critical Infrastructure. Retrieved December 16, 2024.","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"}]}],"mitigations":[],"candidates":[{"id":"0434d081-bb32-42ce-bcbb-3548e4f2628f","name":"Query Registry with Powershell cmdlets","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1012/T1012.yaml","description":"Query Windows Registry with Powershell cmdlets, i.e., Get-Item and Get-ChildItem. The results from above can also be achieved with Get-Item and Get-ChildItem.\nUnlike using \"reg query\" which then executes reg.exe, using cmdlets won't generate new processes, which may evade detection systems monitoring process generation. \n","inputs":{},"dependencies":[],"source_definition_sha256":"546bbc39cd82d71f1eeae6efc4a26f01faa25035ff32ccf1efaa2b15afd0692c"},{"id":"0d80d088-a84c-4353-af1a-fc8b439f1564","name":"Enumerate COM Objects in Registry with Powershell","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1012/T1012.yaml","description":"This test is designed to enumerate the COM objects listed in HKCR, then output their methods and CLSIDs to a text file.\nAn adversary could then use this information to identify COM objects that might be vulnerable to abuse, such as using them to spawn arbitrary processes. \nSee: https://www.mandiant.com/resources/hunting-com-objects","inputs":{"output_file":{"description":"File to output list of COM objects to","type":"string","default":"$env:temp\\T1592.002Test1.txt"}},"dependencies":[],"source_definition_sha256":"b9418fd392ce848b58025b4226990383d2354c6326e2606714d28b70b09b4846"},{"id":"5c784969-1d43-4ac7-8c3d-ed6d025ed10d","name":"Check Software Inventory Logging (SIL) status via Registry","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1012/T1012.yaml","description":"Microsoft's Software Inventory Logging (SIL) collects information about software installed per host basis. Adversary can use such logs to passively \ncheck for existence of software of interest to them. Status of SIL can be checked via registry.\n[Reference](https://blog.talosintelligence.com/chinese-hacking-group-apt41-compromised-taiwanese-government-affiliated-research-institute-with-shadowpad-and-cobaltstrike-2/)\n","inputs":{},"dependencies":[],"source_definition_sha256":"f8d264cc484b8a6e2bb0dbaaafb971eca6f69554e9941819deefd061345a0f14"},{"id":"6fb4c4c5-f949-4fd2-8af5-ddbc61595223","name":"Reg query for AlwaysInstallElevated status","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1012/T1012.yaml","description":"The reg query commands allows to check the status of the AlwaysInstallElevated registry key for both the user and the machine. If both queries return a value of 0x1, then AlwaysInstallElevated is enabled for both user and machine thus allowing a regular user to install a Microsoft Windows Installer package with system level privileges. This can be abused by an attacker to escalate privileges in the host to SYSTEM level.","inputs":{},"dependencies":[],"source_definition_sha256":"2dda1deb232d12d68262d9f42c4fc922b5acf601925d43ae68fb4ef5c55376da"},{"id":"8f7578c4-9863-4d83-875c-a565573bbdf0","name":"Query Registry","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1012/T1012.yaml","description":"Query Windows Registry.\nUpon successful execution, cmd.exe will perform multiple reg queries. Some will succeed and others will fail (dependent upon OS).\nReferences:\nhttps://blog.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order\nhttps://blog.cylance.com/windows-registry-persistence-part-1-introduction-attack-phases-and-windows-services\nhttp://www.handgrep.se/repository/cheatsheets/postexploitation/WindowsPost-Exploitation.pdf\nhttps://www.offensive-security.com/wp-content/uploads/2015/04/wp.Registry_Quick_Find_Chart.en_us.pdf\n","inputs":{},"dependencies":[],"source_definition_sha256":"8974914600aeb061569dda7622eef816ec76f7bfe3e5a5e87405f8f3e9556ebd"},{"id":"96257079-cdc1-4aba-8705-3146e94b6dce","name":"Inspect SystemStartOptions Value in Registry","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1012/T1012.yaml","description":"The objective of this test is to query the SystemStartOptions key under HKLM\\SYSTEM\\CurrentControlSet\\Control in the Windows registry. This action could be used to uncover specific details about how the system is configured to start, potentially aiding in understanding boot parameters or identifying security-related settings. key is.","inputs":{},"dependencies":[],"source_definition_sha256":"00325648f26fccd52602489c081f5e31afb74bd2d84793580c73fbfcd3768ba6"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1012":"/ttp-simulation/techniques/enterprise/T1012/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1012","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0063","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Mode","event_type":"SetValue","value_type":"DWORD","value":1}}]}}