{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1112","id":"T1112","name":"Modify Registry","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1112","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"96189398af638056edce46d8ff43802fef0066ec01c01624c82a8b4a0b1e5471","description":"Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.\n\nAccess to specific areas of the Registry depends on account permissions, with some keys requiring administrator-level access. The built-in Windows command-line utility [Reg](https://attack.mitre.org/software/S0075) may be used for local or remote Registry modification.(Citation: Microsoft Reg) Other tools, such as remote access tools, may also contain functionality to interact with the Registry through the Windows API.\n\nThe Registry may be modified in order to hide configuration information or malicious payloads via [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027).(Citation: Unit42 BabyShark Feb 2019)(Citation: Avaddon Ransomware 2021)(Citation: Microsoft BlackCat Jun 2022)(Citation: CISA Russian Gov Critical Infra 2018) The Registry may also be modified to impair defenses, such as by enabling macros for all Microsoft Office products, allowing privilege escalation without alerting the user, increasing the maximum number of allowed outbound requests, and/or modifying systems to store plaintext credentials in memory.(Citation: CISA LockBit 2023)(Citation: Unit42 BabyShark Feb 2019)\n\nThe Registry of a remote system may be modified to aid in execution of files as part of lateral movement. It requires the remote Registry service to be running on the target system.(Citation: Microsoft Remote) Often [Valid Accounts](https://attack.mitre.org/techniques/T1078) are required, along with access to the remote system's [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) for RPC communication.\n\nFinally, Registry modifications may also include actions to hide keys, such as prepending key names with a null character, which will cause an error and/or be ignored when read via [Reg](https://attack.mitre.org/software/S0075) or other utilities using the Win32 API.(Citation: Microsoft Reghide NOV 2006) Adversaries may abuse these pseudo-hidden keys to conceal payloads/commands used to maintain persistence.(Citation: TrendMicro POWELIKS AUG 2014)(Citation: SpectorOps Hiding Reg Jul 2017)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1112","external_id":"T1112"},{"source_name":"CISA Russian Gov Critical Infra 2018","description":"CISA. (2018, March 16). Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved March 24, 2025.","url":"https://www.cisa.gov/news-events/alerts/2018/03/15/russian-government-cyber-activity-targeting-energy-and-other-critical-infrastructure-sectors"},{"source_name":"CISA LockBit 2023","description":"CISA. (2023, March 16). #StopRansomware: LockBit 3.0. Retrieved March 24, 2025.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-075a"},{"source_name":"Avaddon Ransomware 2021","description":"Javier Yuste and Sergio Pastrana. (2021). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved March 24, 2025.","url":"https://arxiv.org/pdf/2102.04796"},{"source_name":"Microsoft BlackCat Jun 2022","description":"Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.","url":"https://www.microsoft.com/en-us/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/"},{"source_name":"Microsoft Reg","description":"Microsoft. (2012, April 17). Reg. Retrieved May 1, 2015.","url":"https://technet.microsoft.com/en-us/library/cc732643.aspx"},{"source_name":"Microsoft Remote","description":"Microsoft. (n.d.). Enable the Remote Registry Service. Retrieved May 1, 2015.","url":"https://technet.microsoft.com/en-us/library/cc754820.aspx"},{"source_name":"SpectorOps Hiding Reg Jul 2017","description":"Reitz, B. (2017, July 14). Hiding Registry keys with PSReflect. Retrieved August 9, 2018.","url":"https://posts.specterops.io/hiding-registry-keys-with-psreflect-b18ec5ac8353"},{"source_name":"Microsoft Reghide NOV 2006","description":"Russinovich, M. & Sharkey, K. (2006, January 10). Reghide. Retrieved August 9, 2018.","url":"https://docs.microsoft.com/sysinternals/downloads/reghide"},{"source_name":"TrendMicro POWELIKS AUG 2014","description":"Santos, R. (2014, August 1). POWELIKS: Malware Hides In Windows Registry. Retrieved August 9, 2018.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/poweliks-malware-hides-in-windows-registry/"},{"source_name":"Unit42 BabyShark Feb 2019","description":"Unit 42. (2019, February 22). New BabyShark Malware Targets U.S. National Security Think Tanks. Retrieved October 7, 2019.","url":"https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/"}],"platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0063","name":"Windows Registry Key Modification","page":"telemetry/DC0063/","kind":"attack_component","category":"Endpoint activity","description":"Registry value changes or registry object renames.","collection_focus":"Use RegistryEvent 13 for value-set and 14 for rename; compare against intended policy and keep original type/value where available.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","Keep this Windows-specific source separate from other operating systems; there is no direct cross-platform event-ID equivalence."],"configuration_example":null,"required_fields":["registry_path","event_type","value_type","value"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0063","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Mode","event_type":"SetValue","value_type":"DWORD","value":1}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1112","id":"T1112","name":"Modify Registry","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"source_url":"https://attack.mitre.org/techniques/T1112","technique_page":"techniques/enterprise/T1112/","page":"detections/enterprise/T1112/","status":"rule_source_available","counts":{"sigma":78,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[{"id":"35c55673-84ca-4e99-8d09-e334f3c29539","title":"Remote Registry Lateral Movement","status":"test","level":"high","logsource":{"product":"rpc_firewall","category":"application","definition":"Requirements: install and apply the RPC Firewall to all processes with \"audit:true action:block uuid:338cd001-2244-31f1-aaaa-900038001003\""},"data_path":"data/detection-rules/35c55673-84ca-4e99-8d09-e334f3c29539.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/rpc_firewall/rpc_firewall_remote_registry_lateral_movement.yml","author":"Sagie Dulce, Dekel Paz","kind":"sigma"},{"id":"a4c90ea1-2634-4ca0-adbb-35eae169b6fc","title":"ETW Logging Disabled In .NET Processes - Registry","status":"test","level":"high","logsource":{"product":"windows","service":"security"},"data_path":"data/detection-rules/a4c90ea1-2634-4ca0-adbb-35eae169b6fc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_dot_net_etw_tamper.yml","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","kind":"sigma"},{"id":"d3abac66-f11c-4ed0-8acb-50cc29c97eed","title":"NetNTLM Downgrade Attack","status":"test","level":"high","logsource":{"product":"windows","service":"security","definition":"Requirements: Audit Policy : Object Access > Audit Registry (Success)"},"data_path":"data/detection-rules/d3abac66-f11c-4ed0-8acb-50cc29c97eed.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_net_ntlm_downgrade.yml","author":"Florian Roth (Nextron Systems), wagga","kind":"sigma"},{"id":"18beca67-ab3e-4ee3-ba7a-a46ca8d7d0cc","title":"Sysmon Channel Reference Deletion","status":"test","level":"high","logsource":{"product":"windows","service":"security"},"data_path":"data/detection-rules/18beca67-ab3e-4ee3-ba7a-a46ca8d7d0cc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_sysmon_channel_reference_deletion.yml","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","kind":"sigma"},{"id":"2a0a169d-cc66-43ce-9ae2-6e678e54e46a","title":"Registry Modification Attempt Via VBScript - PowerShell","status":"experimental","level":"medium","logsource":{"category":"ps_script","product":"windows"},"data_path":"data/detection-rules/2a0a169d-cc66-43ce-9ae2-6e678e54e46a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_vbscript_registry_modification.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"f63b56ee-3f79-4b8a-97fb-5c48007e8573","title":"New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/f63b56ee-3f79-4b8a-97fb-5c48007e8573.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_dnscmd_install_new_server_level_plugin_dll.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"1a4bd6af-99ac-4466-b5b2-7b72b4a05462","title":"Security Event Logging Disabled via MiniNt Registry Key - Process","status":"experimental","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/1a4bd6af-99ac-4466-b5b2-7b72b4a05462.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_event_logging_disable_via_key_minint.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"8cbc9475-8d05-4e27-9c32-df960716c701","title":"Potentially Suspicious Desktop Background Change Using Reg.EXE","status":"test","level":"medium","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/8cbc9475-8d05-4e27-9c32-df960716c701.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_reg_desktop_background_change.yml","author":"Stephen Lincoln @slincoln-aiq (AttackIQ)","kind":"sigma"},{"id":"62e0298b-e994-4189-bc87-bc699aa62d97","title":"Potential Suspicious Registry File Imported Via Reg.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/62e0298b-e994-4189-bc87-bc699aa62d97.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_reg_import_from_suspicious_paths.yml","author":"frack113, Nasreddine Bencherchali","kind":"sigma"},{"id":"28ac00d6-22d9-4a3c-927f-bbd770104573","title":"RestrictedAdminMode Registry Value Tampering - ProcCreation","status":"test","level":"high","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/28ac00d6-22d9-4a3c-927f-bbd770104573.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_reg_lsa_disable_restricted_admin.yml","author":"frack113","kind":"sigma"},{"id":"98dedfdd-8333-49d4-9f23-d7018cccae53","title":"Enable LM Hash Storage - ProcCreation","status":"test","level":"high","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/98dedfdd-8333-49d4-9f23-d7018cccae53.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_reg_nolmhash.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"0d5675be-bc88-4172-86d3-1e96a4476536","title":"Potential Tampering With RDP Related Registry Keys Via Reg.EXE","status":"test","level":"high","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/0d5675be-bc88-4172-86d3-1e96a4476536.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_reg_rdp_keys_tamper.yml","author":"pH-T (Nextron Systems), @Kostastsale, TheDFIRReport","kind":"sigma"},{"id":"b7e2a8d4-74bb-4b78-adc9-3f92af2d4829","title":"Reg Add Suspicious Paths","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/b7e2a8d4-74bb-4b78-adc9-3f92af2d4829.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_reg_susp_paths.yml","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"73bba97f-a82d-42ce-b315-9182e76c57b1","title":"Imports Registry Key From a File","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/73bba97f-a82d-42ce-b315-9182e76c57b1.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_regedit_import_keys.yml","author":"Oddvar Moe, Sander Wiebing, oscd.community","kind":"sigma"},{"id":"0b80ade5-6997-4b1d-99a1-71701778ea61","title":"Imports Registry Key From an ADS","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/0b80ade5-6997-4b1d-99a1-71701778ea61.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_regedit_import_keys_ads.yml","author":"Oddvar Moe, Sander Wiebing, oscd.community","kind":"sigma"},{"id":"77946e79-97f1-45a2-84b4-f37b5c0d8682","title":"Suspicious Registry Modification From ADS Via Regini.EXE","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/77946e79-97f1-45a2-84b4-f37b5c0d8682.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_regini_ads.yml","author":"Eli Salem, Sander Wiebing, oscd.community","kind":"sigma"},{"id":"5f60740a-f57b-4e76-82a1-15b6ff2cb134","title":"Registry Modification Via Regini.EXE","status":"test","level":"low","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/5f60740a-f57b-4e76-82a1-15b6ff2cb134.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_regini_execution.yml","author":"Eli Salem, Sander Wiebing, oscd.community","kind":"sigma"},{"id":"b0524451-19af-4efa-a46f-562a977f792e","title":"ShimCache Flush","status":"stable","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/b0524451-19af-4efa-a46f-562a977f792e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_rundll32_susp_shimcache_flush.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"198effb6-6c98-4d0c-9ea3-451fa143c45c","title":"Run Once Task Execution as Configured in Registry","status":"test","level":"low","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/198effb6-6c98-4d0c-9ea3-451fa143c45c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_runonce_execution.yml","author":"Avneet Singh @v3t0_, oscd.community, Christopher Peacock @SecurePeacock (updated)","kind":"sigma"},{"id":"8f02c935-effe-45b3-8fc9-ef8696a9e41d","title":"Non-privileged Usage of Reg or Powershell","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/8f02c935-effe-45b3-8fc9-ef8696a9e41d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_non_priv_reg_or_ps.yml","author":"Teymur Kheirkhabarov (idea), Ryan Plas (rule), oscd.community","kind":"sigma"},{"id":"dd3ee8cc-f751-41c9-ba53-5a32ed47e563","title":"Registry Modification of MS-settings Protocol Handler","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/dd3ee8cc-f751-41c9-ba53-5a32ed47e563.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_registry_modification_of_ms_setting_protocol_handler.yml","author":"frack113, Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"8f3ab69a-aa22-4943-aa58-e0a52fdf6818","title":"User Shell Folders Registry Modification via CommandLine","status":"experimental","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/8f3ab69a-aa22-4943-aa58-e0a52fdf6818.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_user_shell_folders_registry_modification.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"921aa10f-2e74-4cca-9498-98f9ca4d6fdf","title":"Registry Modification Attempt Via VBScript","status":"experimental","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/921aa10f-2e74-4cca-9498-98f9ca4d6fdf.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_vbscript_registry_modification.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"b7b19cb6-9b32-4fc4-a108-73f19acfe262","title":"Suspicious VBoxDrvInst.exe Parameters","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/b7b19cb6-9b32-4fc4-a108-73f19acfe262.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_virtualbox_vboxdrvinst_execution.yml","author":"Konstantin Grishchenko, oscd.community","kind":"sigma"},{"id":"c453ab7a-1f5c-4716-a3b4-dea8135fb43a","title":"Registry Manipulation via WMI Stdregprov","status":"experimental","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/c453ab7a-1f5c-4716-a3b4-dea8135fb43a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wmic_stdregprov_reg_modification.yml","author":"Daniel Koifman (KoifSec)","kind":"sigma"},{"id":"07bdd2f5-9c58-4f38-aec8-e101bb79ef8d","title":"Terminal Server Client Connection History Cleared - Registry","status":"test","level":"high","logsource":{"category":"registry_delete","product":"windows"},"data_path":"data/detection-rules/07bdd2f5-9c58-4f38-aec8-e101bb79ef8d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_delete/registry_delete_mstsc_history_cleared.yml","author":"Christian Burkard (Nextron Systems)","kind":"sigma"},{"id":"96f697b0-b499-4e5d-9908-a67bec11cdb6","title":"Removal of Potential COM Hijacking Registry Keys","status":"test","level":"medium","logsource":{"product":"windows","category":"registry_delete"},"data_path":"data/detection-rules/96f697b0-b499-4e5d-9908-a67bec11cdb6.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_delete/registry_delete_removal_com_hijacking_registry_key.yml","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","kind":"sigma"},{"id":"919f2ef0-be2d-4a7a-b635-eb2b41fde044","title":"Disable Security Events Logging Adding Reg Key MiniNt","status":"test","level":"high","logsource":{"category":"registry_event","product":"windows"},"data_path":"data/detection-rules/919f2ef0-be2d-4a7a-b635-eb2b41fde044.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_event/registry_event_disable_security_events_logging_adding_reg_key_minint.yml","author":"Ilyas Ochkov, oscd.community","kind":"sigma"},{"id":"1a2d6c47-75b0-45bd-b133-2c0be75349fd","title":"Wdigest CredGuard Registry Modification","status":"test","level":"high","logsource":{"category":"registry_event","product":"windows"},"data_path":"data/detection-rules/1a2d6c47-75b0-45bd-b133-2c0be75349fd.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_event/registry_event_disable_wdigest_credential_guard.yml","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","kind":"sigma"},{"id":"f7f9ab88-7557-4a69-b30e-0a8f91b3a0e7","title":"Registry Entries For Azorult Malware","status":"test","level":"critical","logsource":{"product":"windows","category":"registry_event"},"data_path":"data/detection-rules/f7f9ab88-7557-4a69-b30e-0a8f91b3a0e7.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_event/registry_event_mal_azorult.yml","author":"Trent Liffick","kind":"sigma"},{"id":"1c8e96cd-2bed-487d-9de0-b46c90cade56","title":"Potential Qakbot Registry Activity","status":"test","level":"high","logsource":{"category":"registry_event","product":"windows"},"data_path":"data/detection-rules/1c8e96cd-2bed-487d-9de0-b46c90cade56.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_event/registry_event_malware_qakbot_registry.yml","author":"Hieu Tran","kind":"sigma"},{"id":"d67572a0-e2ec-45d6-b8db-c100d14b8ef2","title":"NetNTLM Downgrade Attack - Registry","status":"test","level":"high","logsource":{"product":"windows","category":"registry_event"},"data_path":"data/detection-rules/d67572a0-e2ec-45d6-b8db-c100d14b8ef2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_event/registry_event_net_ntlm_downgrade.yml","author":"Florian Roth (Nextron Systems), wagga, Nasreddine Bencherchali (Splunk STRT)","kind":"sigma"},{"id":"5b175490-b652-4b02-b1de-5b5b4083c5f8","title":"RedMimicry Winnti Playbook Registry Manipulation","status":"test","level":"high","logsource":{"product":"windows","category":"registry_event"},"data_path":"data/detection-rules/5b175490-b652-4b02-b1de-5b5b4083c5f8.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_event/registry_event_redmimicry_winnti_reg.yml","author":"Alexander Rausch","kind":"sigma"},{"id":"c74d7efc-8826-45d9-b8bb-f04fac9e4eff","title":"Run Once Task Configuration in Registry","status":"test","level":"medium","logsource":{"product":"windows","category":"registry_event"},"data_path":"data/detection-rules/c74d7efc-8826-45d9-b8bb-f04fac9e4eff.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_event/registry_event_runonce_persistence.yml","author":"Avneet Singh @v3t0_, oscd.community","kind":"sigma"},{"id":"7f4c43f9-b1a5-4c7d-b24a-b41bf3a3ebf2","title":"Registry Tampering by Potentially Suspicious Processes","status":"experimental","level":"medium","logsource":{"category":"registry_event","product":"windows"},"data_path":"data/detection-rules/7f4c43f9-b1a5-4c7d-b24a-b41bf3a3ebf2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_event/registry_event_susp_process_registry_modification.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"37b437cf-3fc5-4c8e-9c94-1d7c9aff842b","title":"Allow RDP Remote Assistance Feature","status":"test","level":"medium","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/37b437cf-3fc5-4c8e-9c94-1d7c9aff842b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_allow_rdp_remote_assistance_feature.yml","author":"frack113","kind":"sigma"},{"id":"53330955-dc52-487f-a3a2-da24dcff99b5","title":"New BgInfo.EXE Custom DB Path Registry Configuration","status":"test","level":"medium","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/53330955-dc52-487f-a3a2-da24dcff99b5.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_bginfo_custom_db.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"992dd79f-dde8-4bb0-9085-6350ba97cfb3","title":"New BgInfo.EXE Custom VBScript Registry Configuration","status":"test","level":"medium","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/992dd79f-dde8-4bb0-9085-6350ba97cfb3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_bginfo_custom_vbscript.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"cd277474-5c52-4423-a52b-ac2d7969902f","title":"New BgInfo.EXE Custom WMI Query Registry Configuration","status":"test","level":"medium","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/cd277474-5c52-4423-a52b-ac2d7969902f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_bginfo_custom_wmi_query.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"ac9159cc-c364-4304-8f0a-d63fc1a0aabb","title":"ClickOnce Trust Prompt Tampering","status":"test","level":"medium","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/ac9159cc-c364-4304-8f0a-d63fc1a0aabb.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_clickonce_trust_prompt.yml","author":"@SerkinValery, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"2ff692c2-4594-41ec-8fcb-46587de769e0","title":"CrashControl CrashDump Disabled","status":"test","level":"medium","logsource":{"product":"windows","category":"registry_set"},"data_path":"data/detection-rules/2ff692c2-4594-41ec-8fcb-46587de769e0.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_crashdump_disabled.yml","author":"Tobias Michalski (Nextron Systems)","kind":"sigma"},{"id":"8839e550-52d7-4958-9f2f-e13c1e736838","title":"Security Event Logging Disabled via MiniNt Registry Key - Registry Set","status":"experimental","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/8839e550-52d7-4958-9f2f-e13c1e736838.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_create_minint_key.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"a07f0359-4c90-4dc4-a681-8ffea40b4f47","title":"Service Binary in Suspicious Folder","status":"test","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/a07f0359-4c90-4dc4-a681-8ffea40b4f47.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_creation_service_susp_folder.yml","author":"Florian Roth (Nextron Systems), frack113","kind":"sigma"},{"id":"85b88e05-dadc-430b-8a9e-53ff1cd30aae","title":"Potentially Suspicious Desktop Background Change Via Registry","status":"test","level":"medium","logsource":{"product":"windows","category":"registry_set"},"data_path":"data/detection-rules/85b88e05-dadc-430b-8a9e-53ff1cd30aae.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_desktop_background_change.yml","author":"Nasreddine Bencherchali (Nextron Systems), Stephen Lincoln @slincoln-aiq (AttackIQ)","kind":"sigma"},{"id":"9d3436ef-9476-4c43-acca-90ce06bdf33a","title":"DHCP Callout DLL Installation","status":"test","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/9d3436ef-9476-4c43-acca-90ce06bdf33a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_dhcp_calloutdll.yml","author":"Dimitrios Slamaris","kind":"sigma"},{"id":"e2482f8d-3443-4237-b906-cc145d87a076","title":"Disable Internal Tools or Feature in Registry","status":"test","level":"medium","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/e2482f8d-3443-4237-b906-cc145d87a076.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_disable_function_user.yml","author":"frack113, Nasreddine Bencherchali (Nextron Systems), CrimpSec","kind":"sigma"},{"id":"3ae1a046-f7db-439d-b7ce-b8b366b81fa6","title":"Disable Windows Security Center Notifications","status":"test","level":"medium","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/3ae1a046-f7db-439d-b7ce-b8b366b81fa6.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_disable_security_center_notifications.yml","author":"frack113","kind":"sigma"},{"id":"ba226dcf-d390-4642-b9af-b534872f1156","title":"Windows Event Log Access Tampering Via Registry","status":"experimental","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/ba226dcf-d390-4642-b9af-b534872f1156.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_disable_windows_event_log_access.yml","author":"X__Junior","kind":"sigma"},{"id":"275641a5-a492-45e2-a817-7c81e9d9d3e9","title":"Add DisallowRun Execution to Registry","status":"test","level":"medium","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/275641a5-a492-45e2-a817-7c81e9d9d3e9.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_disallowrun_execution.yml","author":"frack113","kind":"sigma"},{"id":"04b45a8a-d11d-49e4-9acc-4a1b524407a5","title":"DNS-over-HTTPS Enabled by Registry","status":"test","level":"medium","logsource":{"product":"windows","category":"registry_set"},"data_path":"data/detection-rules/04b45a8a-d11d-49e4-9acc-4a1b524407a5.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_dns_over_https_enabled.yml","author":"Austin Songer","kind":"sigma"},{"id":"e61e8a88-59a9-451c-874e-70fcc9740d67","title":"New DNS ServerLevelPluginDll Installed","status":"test","level":"high","logsource":{"product":"windows","category":"registry_set"},"data_path":"data/detection-rules/e61e8a88-59a9-451c-874e-70fcc9740d67.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_dns_server_level_plugin_dll.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"bf4fc428-dcc3-4bbd-99fe-2422aeee2544","title":"ETW Logging Disabled In .NET Processes - Sysmon Registry","status":"test","level":"high","logsource":{"product":"windows","category":"registry_set"},"data_path":"data/detection-rules/bf4fc428-dcc3-4bbd-99fe-2422aeee2544.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_dot_net_etw_tamper.yml","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","kind":"sigma"},{"id":"e3fdf743-f05b-4051-990a-b66919be1743","title":"Change User Account Associated with the FAX Service","status":"test","level":"high","logsource":{"product":"windows","category":"registry_set"},"data_path":"data/detection-rules/e3fdf743-f05b-4051-990a-b66919be1743.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_fax_change_service_user.yml","author":"frack113","kind":"sigma"},{"id":"9e3357ba-09d4-4fbd-a7c5-ad6386314513","title":"Change the Fax Dll","status":"test","level":"high","logsource":{"product":"windows","category":"registry_set"},"data_path":"data/detection-rules/9e3357ba-09d4-4fbd-a7c5-ad6386314513.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_fax_dll_persistance.yml","author":"frack113","kind":"sigma"},{"id":"5a93eb65-dffa-4543-b761-94aa60098fb6","title":"Registry Hide Function from User","status":"test","level":"medium","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/5a93eb65-dffa-4543-b761-94aa60098fb6.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_hide_function_user.yml","author":"frack113","kind":"sigma"},{"id":"d6ce7ebd-260b-4323-9768-a9631c8d4db2","title":"RestrictedAdminMode Registry Value Tampering","status":"test","level":"high","logsource":{"product":"windows","category":"registry_set"},"data_path":"data/detection-rules/d6ce7ebd-260b-4323-9768-a9631c8d4db2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_lsa_disablerestrictedadmin.yml","author":"frack113","kind":"sigma"},{"id":"28036918-04d3-423d-91c0-55ecf99fb892","title":"NET NGenAssemblyUsageLog Registry Key Tamper","status":"test","level":"high","logsource":{"product":"windows","category":"registry_set"},"data_path":"data/detection-rules/28036918-04d3-423d-91c0-55ecf99fb892.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_net_cli_ngenassemblyusagelog.yml","author":"frack113","kind":"sigma"},{"id":"1a5c46e9-f32f-42f7-b2bc-6e9084db7fbf","title":"Trust Access Disable For VBApplications","status":"test","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/1a5c46e9-f32f-42f7-b2bc-6e9084db7fbf.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_office_access_vbom_tamper.yml","author":"Trent Liffick (@tliffick), Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"6763c6c8-bd01-4687-bc8d-4fa52cf8ba08","title":"Outlook EnableUnsafeClientMailRules Setting Enabled - Registry","status":"test","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/6763c6c8-bd01-4687-bc8d-4fa52cf8ba08.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_office_outlook_enable_unsafe_client_mail_rules.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd","title":"Macro Enabled In A Potentially Suspicious Document","status":"test","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_office_trust_record_susp_location.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"f742bde7-9528-42e5-bd82-84f51a8387d2","title":"Uncommon Microsoft Office Trusted Location Added","status":"test","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/f742bde7-9528-42e5-bd82-84f51a8387d2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_office_trusted_location_uncommon.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"91239011-fe3c-4b54-9f24-15c86bb65913","title":"Office Macros Warning Disabled","status":"test","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/91239011-fe3c-4b54-9f24-15c86bb65913.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_office_vba_warnings_tamper.yml","author":"Trent Liffick (@tliffick), Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"fdbf0b9d-0182-4c43-893b-a1eaab92d085","title":"Potential Persistence Via Custom Protocol Handler","status":"test","level":"medium","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/fdbf0b9d-0182-4c43-893b-a1eaab92d085.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_persistence_custom_protocol_handler.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"a1e11042-a74a-46e6-b07c-c4ce8ecc239b","title":"Potential Persistence Via Event Viewer Events.asp","status":"test","level":"medium","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/a1e11042-a74a-46e6-b07c-c4ce8ecc239b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_persistence_event_viewer_events_asp.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"d88d0ab2-e696-4d40-a2ed-9790064e66b3","title":"Modification of IE Registry Settings","status":"test","level":"low","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/d88d0ab2-e696-4d40-a2ed-9790064e66b3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_persistence_ie.yml","author":"frack113","kind":"sigma"},{"id":"ddd171b5-2cc6-4975-9e78-f0eccd08cc76","title":"Potential Persistence Via Outlook Home Page","status":"test","level":"high","logsource":{"product":"windows","category":"registry_set"},"data_path":"data/detection-rules/ddd171b5-2cc6-4975-9e78-f0eccd08cc76.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_persistence_outlook_homepage.yml","author":"Tobias Michalski (Nextron Systems), David Bertho (@dbertho) & Eirik Sveen (@0xSV1), Storebrand","kind":"sigma"},{"id":"487bb375-12ef-41f6-baae-c6a1572b4dd1","title":"Potential Persistence Via Outlook Today Page","status":"test","level":"high","logsource":{"product":"windows","category":"registry_set"},"data_path":"data/detection-rules/487bb375-12ef-41f6-baae-c6a1572b4dd1.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_persistence_outlook_todaypage.yml","author":"Tobias Michalski (Nextron Systems), David Bertho (@dbertho) & Eirik Sveen (@0xSV1), Storebrand","kind":"sigma"},{"id":"c0e0bdec-3e3d-47aa-9974-05539c999c89","title":"Registry Modification for OCI DLL Redirection","status":"experimental","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/c0e0bdec-3e3d-47aa-9974-05539c999c89.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_potential_oci_dll_redirection.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"fecfd1a1-cc78-4313-a1ea-2ee2e8ec27a7","title":"PowerShell Logging Disabled Via Registry Key Tampering","status":"test","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/fecfd1a1-cc78-4313-a1ea-2ee2e8ec27a7.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_powershell_logging_disabled.yml","author":"frack113","kind":"sigma"},{"id":"90f342e1-1aaa-4e43-b092-39fda57ed11e","title":"ETW Logging Disabled For rpcrt4.dll","status":"test","level":"low","logsource":{"product":"windows","category":"registry_set"},"data_path":"data/detection-rules/90f342e1-1aaa-4e43-b092-39fda57ed11e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_rpcrt4_etw_tamper.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"4f281b83-0200-4b34-bf35-d24687ea57c2","title":"ETW Logging Disabled For SCM","status":"test","level":"low","logsource":{"product":"windows","category":"registry_set"},"data_path":"data/detection-rules/4f281b83-0200-4b34-bf35-d24687ea57c2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_services_etw_tamper.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"1c3121ed-041b-4d97-a075-07f54f20fb4a","title":"Registry Explorer Policy Modification","status":"test","level":"medium","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/1c3121ed-041b-4d97-a075-07f54f20fb4a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_set_nopolicies_user.yml","author":"frack113","kind":"sigma"},{"id":"0c93308a-3f1b-40a9-b649-57ea1a1c1d63","title":"Activate Suppression of Windows Security Center Notifications","status":"test","level":"medium","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/0c93308a-3f1b-40a9-b649-57ea1a1c1d63.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_suppress_defender_notifications.yml","author":"frack113","kind":"sigma"},{"id":"c420410f-c2d8-4010-856b-dffe21866437","title":"Enable LM Hash Storage","status":"test","level":"high","logsource":{"product":"windows","category":"registry_set"},"data_path":"data/detection-rules/c420410f-c2d8-4010-856b-dffe21866437.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_system_lsa_nolmhash.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"a2863fbc-d5cb-48d5-83fb-d976d4b1743b","title":"RDP Sensitive Settings Changed to Zero","status":"test","level":"medium","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/a2863fbc-d5cb-48d5-83fb-d976d4b1743b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_terminal_server_suspicious.yml","author":"Samir Bousseaden, David ANDRE, Roberto Rodriguez @Cyb3rWard0g, Nasreddine Bencherchali","kind":"sigma"},{"id":"3f6b7b62-61aa-45db-96bd-9c31b36b653c","title":"RDP Sensitive Settings Changed","status":"test","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/3f6b7b62-61aa-45db-96bd-9c31b36b653c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_terminal_server_tampering.yml","author":"Samir Bousseaden, David ANDRE, Roberto Rodriguez @Cyb3rWard0g, Nasreddine Bencherchali","kind":"sigma"},{"id":"d6a9b252-c666-4de6-8806-5561bbbd3bdc","title":"Wdigest Enable UseLogonCredential","status":"test","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/d6a9b252-c666-4de6-8806-5561bbbd3bdc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_wdigest_enable_uselogoncredential.yml","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","kind":"sigma"},{"id":"f7997770-92c3-4ec9-b112-774c4ef96f96","title":"Winlogon AllowMultipleTSSessions Enable","status":"test","level":"medium","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/f7997770-92c3-4ec9-b112-774c4ef96f96.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_winlogon_allow_multiple_tssessions.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0280","name":"Behavior-Based Registry Modification Detection on Windows","url":"https://attack.mitre.org/detectionstrategies/DET0280","stix_id":"x-mitre-detection-strategy--cf6a38ec-4c16-4c7f-8730-6e04f6dd6e67","relationship_id":"relationship--964280e0-838f-4d22-a1e6-70a853be314a","description":"","analytics":[{"id":"AN0781","name":"Analytic 0781","guidance":"Behavior chain involving abnormal registry modifications via CLI, PowerShell, WMI, or direct API calls, especially targeting persistence, privilege escalation, or defense evasion keys, potentially followed by service restart or process execution. Such as editing Notify/Userinit/Startup keys, or disabling SafeDllSearchMode.","url":"https://attack.mitre.org/detectionstrategies/DET0280#AN0781","platforms":["Windows"],"tuning":[{"field":"RegistryKeyPathPatterns","description":"Environment-specific list of monitored or critical registry keys, e.g., Run, Services, Security Settings, LSASS"},{"field":"ParentProcessAllowList","description":"Allowlist of legitimate registry tools (e.g., regedit.exe, msiexec.exe); used to filter known safe writes"},{"field":"TimeWindow","description":"Correlate registry change with nearby process/service execution within a defined timeframe"},{"field":"SignatureCheck","description":"Flag unsigned executables or abnormal parent-child lineage performing registry modification"}],"log_sources":[{"component_id":"DC0063","component":"Windows Registry Key Modification","name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","platforms":["Windows"],"analytic_id":"AN0781","source_url":"https://attack.mitre.org/detectionstrategies/DET0280#AN0781","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0063/"},{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN0781","source_url":"https://attack.mitre.org/detectionstrategies/DET0280#AN0781","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]}]}],"telemetry_references":[{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0063","name":"Windows Registry Key Modification","tag":"Windows Registry Key Modification","page":"telemetry/DC0063/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0677","name":"AADInternals","page":"tools/S0677/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]},{"id":"S0488","name":"CrackMapExec","page":"tools/S0488/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0527","name":"CSPY Downloader","page":"tools/S0527/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1131","name":"NPPSPY","page":"tools/S1131/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1050","name":"PcShare","page":"tools/S1050/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0262","name":"QuasarRAT","page":"tools/S0262/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0075","name":"Reg","page":"tools/S0075/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0332","name":"Remcos","page":"tools/S0332/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0677","name":"AADInternals","page":"tools/S0677/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]},{"id":"S0488","name":"CrackMapExec","page":"tools/S0488/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0527","name":"CSPY Downloader","page":"tools/S0527/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1131","name":"NPPSPY","page":"tools/S1131/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1050","name":"PcShare","page":"tools/S1050/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0262","name":"QuasarRAT","page":"tools/S0262/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0075","name":"Reg","page":"tools/S0075/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0332","name":"Remcos","page":"tools/S0332/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0011","name":"Taidoor","url":"https://attack.mitre.org/software/S0011","kind":"malware","description":"[Taidoor](https://attack.mitre.org/software/S0011) has the ability to modify the Registry on compromised hosts using <code>RegDeleteValueA</code> and <code>RegCreateKeyExA</code>.(Citation: CISA MAR-10292089-1.v2 TAIDOOR August 2021)","relationship_id":"relationship--2e8e6362-ce7e-4fd5-8c9b-8b85b6f35a58","references":[{"source_name":"CISA MAR-10292089-1.v2 TAIDOOR August 2021","description":"CISA, FBI, DOD. (2021, August). MAR-10292089-1.v2 – Chinese Remote Access Trojan: TAIDOOR. Retrieved August 24, 2021.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-216a"}]},{"id":"S0012","name":"PoisonIvy","url":"https://attack.mitre.org/software/S0012","kind":"malware","description":"[PoisonIvy](https://attack.mitre.org/software/S0012) creates a Registry subkey that registers a new system device.(Citation: Symantec Darkmoon Aug 2005)","relationship_id":"relationship--19161920-e6b5-481f-a240-62f05c624010","references":[{"source_name":"Symantec Darkmoon Aug 2005","description":"Hayashi, K. (2005, August 18). Backdoor.Darkmoon. Retrieved February 23, 2018.","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2005-081910-3934-99"}]},{"id":"S0013","name":"PlugX","url":"https://attack.mitre.org/software/S0013","kind":"malware","description":"[PlugX](https://attack.mitre.org/software/S0013) has a module to create, delete, or modify Registry keys.(Citation: Eset PlugX Korplug Mustang Panda March 2022)(Citation: CIRCL PlugX March 2013)(Citation: DOJ Affidavit Search and Seizure PlugX December 2024)","relationship_id":"relationship--067ece2b-4e66-437f-88e0-8dc3f076331b","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","description":"Alexandre Cote Cyr. (2022, March 23). Mustang Panda’s Hodur: Old tricks, new Korplug variant. Retrieved September 9, 2025.","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source_name":"CIRCL PlugX March 2013","description":"Computer Incident Response Center Luxembourg. (2013, March 29). Analysis of a PlugX variant. Retrieved November 5, 2018.","url":"http://circl.lu/assets/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf"},{"source_name":"DOJ Affidavit Search and Seizure PlugX December 2024","description":"DOJ. (2024, December 20). Mag. No. 24-mj-1387 AFFIDAVIT IN SUPPORT OF AN APPLICATION  FOR A NINTH SEARCH AND SEIZURE WARRANT- IN THE MATTER OF THE SEARCH AND  SEIZURE OF COMPUTERS IN THE  UNITED STATES INFECTED WITH  PLUGX MALWARE . Retrieved September 9, 2025.","url":"https://www.justice.gov/archives/opa/media/1384136/dl"}]},{"id":"S0019","name":"Regin","url":"https://attack.mitre.org/software/S0019","kind":"malware","description":"[Regin](https://attack.mitre.org/software/S0019) appears to have functionality to modify remote Registry information.(Citation: Kaspersky Regin)","relationship_id":"relationship--fe3c4134-ddef-45f8-b83a-6865a01b9764","references":[{"source_name":"Kaspersky Regin","description":"Kaspersky Lab's Global Research and Analysis Team. (2014, November 24). THE REGIN PLATFORM NATION-STATE OWNAGE OF GSM NETWORKS. Retrieved December 1, 2014.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08070305/Kaspersky_Lab_whitepaper_Regin_platform_eng.pdf"}]},{"id":"S0022","name":"Uroburos","url":"https://attack.mitre.org/software/S0022","kind":"malware","description":"[Uroburos](https://attack.mitre.org/software/S0022) can store configuration information in the Registry including the initialization vector and AES key needed to find and decrypt other [Uroburos](https://attack.mitre.org/software/S0022) components.(Citation: Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023)","relationship_id":"relationship--61360c2f-0a26-49ca-ac7c-2758fcd26ea2","references":[{"source_name":"Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023","description":"FBI et al. (2023, May 9). Hunting Russian Intelligence “Snake” Malware. Retrieved June 8, 2023.","url":"https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf"}]},{"id":"S0023","name":"CHOPSTICK","url":"https://attack.mitre.org/software/S0023","kind":"malware","description":"[CHOPSTICK](https://attack.mitre.org/software/S0023) may modify Registry keys to store RC4 encrypted configuration information.(Citation: FireEye APT28)","relationship_id":"relationship--40a8f80d-5497-4218-849c-3c0b63796641","references":[{"source_name":"FireEye APT28","description":"FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.","url":"https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf"}]},{"id":"S0031","name":"BACKSPACE","url":"https://attack.mitre.org/software/S0031","kind":"malware","description":"[BACKSPACE](https://attack.mitre.org/software/S0031) is capable of deleting Registry keys, sub-keys, and values on a victim system.(Citation: FireEye APT30)","relationship_id":"relationship--2dec6ce1-e459-4266-86d5-f336ab056f17","references":[{"source_name":"FireEye APT30","description":"FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved November 17, 2024.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf"}]},{"id":"S0032","name":"gh0st RAT","url":"https://attack.mitre.org/software/S0032","kind":"malware","description":"[gh0st RAT](https://attack.mitre.org/software/S0032) has altered the InstallTime subkey.(Citation: Gh0stRAT ATT March 2019)","relationship_id":"relationship--0f4c2cab-c3ca-4f31-8557-485248b65761","references":[{"source_name":"Gh0stRAT ATT March 2019","description":"Quinn, J. (2019, March 25). The odd case of a Gh0stRAT variant. Retrieved July 15, 2020.","url":"https://cybersecurity.att.com/blogs/labs-research/the-odd-case-of-a-gh0strat-variant"}]},{"id":"S0045","name":"ADVSTORESHELL","url":"https://attack.mitre.org/software/S0045","kind":"malware","description":"[ADVSTORESHELL](https://attack.mitre.org/software/S0045) is capable of setting and deleting Registry values.(Citation: Bitdefender APT28 Dec 2015)","relationship_id":"relationship--a71256aa-a2e3-447c-ba4e-004ba4f062b2","references":[{"source_name":"Bitdefender APT28 Dec 2015","description":"Bitdefender. (2015, December). APT28 Under the Scope. Retrieved February 23, 2017.","url":"https://download.bitdefender.com/resources/media/materials/white-papers/en/Bitdefender_In-depth_analysis_of_APT28%E2%80%93The_Political_Cyber-Espionage.pdf"}]},{"id":"S0075","name":"Reg","url":"https://attack.mitre.org/software/S0075","kind":"tool","description":"[Reg](https://attack.mitre.org/software/S0075) may be used to interact with and modify the Windows Registry of a local or remote system at the command-line interface.(Citation: Microsoft Reg)","relationship_id":"relationship--baabf444-1748-472f-b991-7a5b25e4e1bb","references":[{"source_name":"Microsoft Reg","description":"Microsoft. (2012, April 17). Reg. Retrieved May 1, 2015.","url":"https://technet.microsoft.com/en-us/library/cc732643.aspx"}]},{"id":"S0090","name":"Rover","url":"https://attack.mitre.org/software/S0090","kind":"malware","description":"[Rover](https://attack.mitre.org/software/S0090) has functionality to remove Registry Run key persistence as a cleanup procedure.(Citation: Palo Alto Rover)","relationship_id":"relationship--bad90106-a150-4d76-b39f-f35aab4ac766","references":[{"source_name":"Palo Alto Rover","description":"Ray, V., Hayashi, K. (2016, February 29). New Malware ‘Rover’ Targets Indian Ambassador to Afghanistan. Retrieved February 29, 2016.","url":"http://researchcenter.paloaltonetworks.com/2016/02/new-malware-rover-targets-indian-ambassador-to-afghanistan/"}]},{"id":"S0115","name":"Crimson","url":"https://attack.mitre.org/software/S0115","kind":"malware","description":"[Crimson](https://attack.mitre.org/software/S0115) can set a Registry key to determine how long it has been installed and possibly to indicate the version number.(Citation: Proofpoint Operation Transparent Tribe March 2016)","relationship_id":"relationship--924b50b9-7de3-4036-b732-c87d08971122","references":[{"source_name":"Proofpoint Operation Transparent Tribe March 2016","description":"Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"}]},{"id":"S0126","name":"ComRAT","url":"https://attack.mitre.org/software/S0126","kind":"malware","description":"[ComRAT](https://attack.mitre.org/software/S0126) has modified Registry values to store encrypted orchestrator code and payloads.(Citation: ESET ComRAT May 2020)(Citation: CISA ComRAT Oct 2020) ","relationship_id":"relationship--c2496cf4-b502-44cf-ae85-efb9b882a4b1","references":[{"source_name":"CISA ComRAT Oct 2020","description":"CISA. (2020, October 29). Malware Analysis Report (AR20-303A). Retrieved December 9, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-303a"},{"source_name":"ESET ComRAT May 2020","description":"Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"}]},{"id":"S0140","name":"Shamoon","url":"https://attack.mitre.org/software/S0140","kind":"malware","description":"Once [Shamoon](https://attack.mitre.org/software/S0140) has access to a network share, it enables the RemoteRegistry service on the target system. It will then connect to the system with RegConnectRegistryW and modify the Registry to disable UAC remote restrictions by setting <code>SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\LocalAccountTokenFilterPolicy</code> to 1.(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: McAfee Shamoon December 2018)","relationship_id":"relationship--af9347a3-00a9-4ece-b075-8c55bd4f4b9b","references":[{"source_name":"Palo Alto Shamoon Nov 2016","description":"Falcone, R.. (2016, November 30). Shamoon 2: Return of the Disttrack Wiper. Retrieved January 11, 2017.","url":"http://researchcenter.paloaltonetworks.com/2016/11/unit42-shamoon-2-return-disttrack-wiper/"},{"source_name":"FireEye Shamoon Nov 2016","description":"FireEye. (2016, November 30). FireEye Responds to Wave of Destructive Cyber Attacks in Gulf Region. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20210126065851/https://www.fireeye.com/blog/threat-research/2016/11/fireeye_respondsto.html"},{"source_name":"McAfee Shamoon December 2018","description":"Mundo, A., Roccia, T., Saavedra-Morales, J., Beek, C.. (2018, December 14). Shamoon Returns to Wipe Systems in Middle East, Europe . Retrieved May 29, 2020.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/shamoon-returns-to-wipe-systems-in-middle-east-europe/"}]},{"id":"S0142","name":"StreamEx","url":"https://attack.mitre.org/software/S0142","kind":"malware","description":"[StreamEx](https://attack.mitre.org/software/S0142) has the ability to modify the Registry.(Citation: Cylance Shell Crew Feb 2017)","relationship_id":"relationship--69bff194-c90e-4e30-a369-57da4cff014d","references":[{"source_name":"Cylance Shell Crew Feb 2017","description":"Cylance SPEAR Team. (2017, February 9). Shell Crew Variants Continue to Fly Under Big AV’s Radar. Retrieved February 15, 2017.","url":"https://www.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"}]},{"id":"S0148","name":"RTM","url":"https://attack.mitre.org/software/S0148","kind":"malware","description":"[RTM](https://attack.mitre.org/software/S0148) can delete all Registry entries created during its execution.(Citation: ESET RTM Feb 2017)","relationship_id":"relationship--94b4de9a-1f83-4923-8d4b-e9bafdb1bef9","references":[{"source_name":"ESET RTM Feb 2017","description":"Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.","url":"https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf"}]},{"id":"S0154","name":"Cobalt Strike","url":"https://attack.mitre.org/software/S0154","kind":"malware","description":"[Cobalt Strike](https://attack.mitre.org/software/S0154) can modify Registry values within <code>HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\<Excel Version>\\Excel\\Security\\AccessVBOM\\</code> to enable the execution of additional code.(Citation: Talos Cobalt Strike September 2020)","relationship_id":"relationship--45376fe9-2a43-4e09-942e-82be661ed572","references":[{"source_name":"Talos Cobalt Strike September 2020","description":"Mavis, N. (2020, September 21). The Art and Science of Detecting Cobalt Strike. Retrieved September 12, 2024.","url":"https://web.archive.org/web/20210219195905/https://talos-intelligence-site.s3.amazonaws.com/production/document_files/files/000/095/031/original/Talos_Cobalt_Strike.pdf"}]},{"id":"S0157","name":"SOUNDBITE","url":"https://attack.mitre.org/software/S0157","kind":"malware","description":"[SOUNDBITE](https://attack.mitre.org/software/S0157) is capable of modifying the Registry.(Citation: FireEye APT32 May 2017)","relationship_id":"relationship--6592447f-31c8-46d0-8e88-47584fa301f0","references":[{"source_name":"FireEye APT32 May 2017","description":"Carr, N.. (2017, May 14). Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations. Retrieved June 18, 2017.","url":"https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"}]},{"id":"S0158","name":"PHOREAL","url":"https://attack.mitre.org/software/S0158","kind":"malware","description":"[PHOREAL](https://attack.mitre.org/software/S0158) is capable of manipulating the Registry.(Citation: FireEye APT32 May 2017)","relationship_id":"relationship--202b96f6-0f7c-4aed-8004-780f1d880059","references":[{"source_name":"FireEye APT32 May 2017","description":"Carr, N.. (2017, May 14). Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations. Retrieved June 18, 2017.","url":"https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"}]},{"id":"S0180","name":"Volgmer","url":"https://attack.mitre.org/software/S0180","kind":"malware","description":"[Volgmer](https://attack.mitre.org/software/S0180) modifies the Registry to store an encoded configuration file in <code>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\WMI\\Security</code>.(Citation: US-CERT Volgmer 2 Nov 2017)(Citation: Symantec Volgmer Aug 2014)","relationship_id":"relationship--bd8fec61-37c8-489b-a74b-424ff85222ad","references":[{"source_name":"US-CERT Volgmer 2 Nov 2017","description":"US-CERT. (2017, November 01). Malware Analysis Report (MAR) - 10135536-D. Retrieved July 16, 2018.","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-D_WHITE_S508C.PDF"},{"source_name":"Symantec Volgmer Aug 2014","description":"Yagi, J. (2014, August 24). Trojan.Volgmer. Retrieved July 16, 2018.","url":"https://web.archive.org/web/20181126143456/https://www.symantec.com/security-center/writeup/2014-081811-3237-99?tabid=2"}]},{"id":"S0198","name":"NETWIRE","url":"https://attack.mitre.org/software/S0198","kind":"malware","description":"[NETWIRE](https://attack.mitre.org/software/S0198) can modify the Registry to store its configuration information.(Citation: Red Canary NETWIRE January 2020)","relationship_id":"relationship--e0c53a14-01d3-42f6-9dea-6cb60ac72025","references":[{"source_name":"Red Canary NETWIRE January 2020","description":"Lambert, T. (2020, January 29). Intro to Netwire. Retrieved January 7, 2021.","url":"https://redcanary.com/blog/netwire-remote-access-trojan-on-linux/"}]},{"id":"S0203","name":"Hydraq","url":"https://attack.mitre.org/software/S0203","kind":"malware","description":"[Hydraq](https://attack.mitre.org/software/S0203) creates a Registry subkey to register its created service, and can also uninstall itself later by deleting this value. [Hydraq](https://attack.mitre.org/software/S0203)'s backdoor also enables remote attackers to modify and delete subkeys.(Citation: Symantec Trojan.Hydraq Jan 2010)(Citation: Symantec Hydraq Jan 2010)","relationship_id":"relationship--541855dd-0249-4f63-8e95-0024f760484e","references":[{"source_name":"Symantec Trojan.Hydraq Jan 2010","description":"Symantec Security Response. (2010, January 18). The Trojan.Hydraq Incident. Retrieved February 20, 2018.","url":"https://www.symantec.com/connect/blogs/trojanhydraq-incident"},{"source_name":"Symantec Hydraq Jan 2010","description":"Lelli, A. (2010, January 11). Trojan.Hydraq. Retrieved February 20, 2018.","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2010-011114-1830-99"}]},{"id":"S0205","name":"Naid","url":"https://attack.mitre.org/software/S0205","kind":"malware","description":"[Naid](https://attack.mitre.org/software/S0205) creates Registry entries that store information about a created service and point to a malicious DLL dropped to disk.(Citation: Symantec Naid June 2012)","relationship_id":"relationship--aea0804f-e322-401f-a012-c16c25e0ac70","references":[{"source_name":"Symantec Naid June 2012","description":"Neville, A. (2012, June 15). Trojan.Naid. Retrieved February 22, 2018.","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2012-061518-4639-99"}]},{"id":"S0210","name":"Nerex","url":"https://attack.mitre.org/software/S0210","kind":"malware","description":"[Nerex](https://attack.mitre.org/software/S0210) creates a Registry subkey that registers a new service.(Citation: Symantec Nerex May 2012)","relationship_id":"relationship--f7ded6a1-043e-437a-8a0c-00ded73e5289","references":[{"source_name":"Symantec Nerex May 2012","description":"Ladley, F. (2012, May 15). Backdoor.Nerex. Retrieved February 23, 2018.","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2012-051515-3445-99"}]},{"id":"S0229","name":"Orz","url":"https://attack.mitre.org/software/S0229","kind":"malware","description":"[Orz](https://attack.mitre.org/software/S0229) can perform Registry operations.(Citation: Proofpoint Leviathan Oct 2017)","relationship_id":"relationship--93addaa1-7baa-4fdd-ab92-3e58865a5ef2","references":[{"source_name":"Proofpoint Leviathan Oct 2017","description":"Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.","url":"https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"}]},{"id":"S0239","name":"Bankshot","url":"https://attack.mitre.org/software/S0239","kind":"malware","description":"[Bankshot](https://attack.mitre.org/software/S0239) writes data into the Registry key <code>HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Pniumj</code>.(Citation: US-CERT Bankshot Dec 2017)","relationship_id":"relationship--c0d119a2-c5f9-4c18-a18c-28bfa576ea9a","references":[{"source_name":"US-CERT Bankshot Dec 2017","description":"US-CERT. (2017, December 13). Malware Analysis Report (MAR) - 10135536-B. Retrieved July 17, 2018.","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-B_WHITE.PDF"}]},{"id":"S0240","name":"ROKRAT","url":"https://attack.mitre.org/software/S0240","kind":"malware","description":"[ROKRAT](https://attack.mitre.org/software/S0240) can modify the `HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\` registry key so it can bypass the VB object model (VBOM) on a compromised host.(Citation: Malwarebytes RokRAT VBA January 2021)","relationship_id":"relationship--0ae212be-c07b-4f62-8c5e-9dfc0472254e","references":[{"source_name":"Malwarebytes RokRAT VBA January 2021","description":"Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.","url":"https://blog.malwarebytes.com/threat-analysis/2021/01/retrohunting-apt37-north-korean-apt-used-vba-self-decode-technique-to-inject-rokrat/"}]},{"id":"S0242","name":"SynAck","url":"https://attack.mitre.org/software/S0242","kind":"malware","description":"[SynAck](https://attack.mitre.org/software/S0242) can manipulate Registry keys.(Citation: SecureList SynAck Doppelgänging May 2018)","relationship_id":"relationship--109b2118-d714-41bb-a39d-b1fd1b755b55","references":[{"source_name":"SecureList SynAck Doppelgänging May 2018","description":"Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.","url":"https://securelist.com/synack-targeted-ransomware-uses-the-doppelganging-technique/85431/"}]},{"id":"S0245","name":"BADCALL","url":"https://attack.mitre.org/software/S0245","kind":"malware","description":"[BADCALL](https://attack.mitre.org/software/S0245) modifies the firewall Registry key <code>SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfileGloballyOpenPorts\\\\List</code>.(Citation: US-CERT BADCALL)","relationship_id":"relationship--7e559e10-483a-42ca-8ddf-d8ca04ed8bd2","references":[{"source_name":"US-CERT BADCALL","description":"US-CERT. (2018, February 06). Malware Analysis Report (MAR) - 10135536-G. Retrieved June 7, 2018.","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-G.PDF"}]},{"id":"S0254","name":"PLAINTEE","url":"https://attack.mitre.org/software/S0254","kind":"malware","description":"[PLAINTEE](https://attack.mitre.org/software/S0254) uses <code>reg add</code> to add a Registry Run key for persistence.(Citation: Rancor Unit42 June 2018)","relationship_id":"relationship--5bbe7733-4e20-4ee1-a29c-b8e7111781dd","references":[{"source_name":"Rancor Unit42 June 2018","description":"Ash, B., et al. (2018, June 26). RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families. Retrieved July 2, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"}]},{"id":"S0256","name":"Mosquito","url":"https://attack.mitre.org/software/S0256","kind":"malware","description":"[Mosquito](https://attack.mitre.org/software/S0256) can modify Registry keys under <code>HKCU\\Software\\Microsoft\\[dllname]</code> to store configuration values. [Mosquito](https://attack.mitre.org/software/S0256) also modifies Registry keys under <code>HKCR\\CLSID\\...\\InprocServer32</code> with a path to the launcher.(Citation: ESET Turla Mosquito Jan 2018)","relationship_id":"relationship--67e6b603-a45d-4cbc-9b3e-546392934f7f","references":[{"source_name":"ESET Turla Mosquito Jan 2018","description":"ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.","url":"https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"}]},{"id":"S0260","name":"InvisiMole","url":"https://attack.mitre.org/software/S0260","kind":"malware","description":"[InvisiMole](https://attack.mitre.org/software/S0260) has a command to create, set, copy, or delete a specified Registry key or value.(Citation: ESET InvisiMole June 2018)(Citation: ESET InvisiMole June 2020)","relationship_id":"relationship--66f5e718-f910-487f-852a-98a8d752b0ba","references":[{"source_name":"ESET InvisiMole June 2018","description":"Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018.","url":"https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"},{"source_name":"ESET InvisiMole June 2020","description":"Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"}]},{"id":"S0261","name":"Catchamas","url":"https://attack.mitre.org/software/S0261","kind":"malware","description":"[Catchamas](https://attack.mitre.org/software/S0261) creates three Registry keys to establish persistence by adding a [Windows Service](https://attack.mitre.org/techniques/T1543/003).(Citation: Symantec Catchamas April 2018)","relationship_id":"relationship--0dd74596-509c-4669-9d29-e1fb501c9c70","references":[{"source_name":"Symantec Catchamas April 2018","description":"Balanza, M. (2018, April 02). Infostealer.Catchamas. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20190508165711/https://www-west.symantec.com/content/symantec/english/en/security-center/writeup.html/2018-040209-1742-99"}]},{"id":"S0262","name":"QuasarRAT","url":"https://attack.mitre.org/software/S0262","kind":"tool","description":"[QuasarRAT](https://attack.mitre.org/software/S0262) has a command to edit the Registry on the victim’s machine.(Citation: GitHub QuasarRAT)(Citation: CISA AR18-352A Quasar RAT December 2018)","relationship_id":"relationship--53e09f15-3162-4480-8eb4-709e9c18d7fb","references":[{"source_name":"CISA AR18-352A Quasar RAT December 2018","description":"CISA. (2018, December 18). Analysis Report (AR18-352A) Quasar Open-Source Remote Administration Tool. Retrieved August 1, 2022.","url":"https://www.cisa.gov/uscert/ncas/analysis-reports/AR18-352A"},{"source_name":"GitHub QuasarRAT","description":"MaxXor. (n.d.). QuasarRAT. Retrieved July 10, 2018.","url":"https://github.com/quasar/QuasarRAT"}]},{"id":"S0263","name":"TYPEFRAME","url":"https://attack.mitre.org/software/S0263","kind":"malware","description":"[TYPEFRAME](https://attack.mitre.org/software/S0263) can install encrypted configuration data under the Registry key <code>HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\laxhost.dll</code> and <code>HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\PrintConfigs</code>.(Citation: US-CERT TYPEFRAME June 2018)","relationship_id":"relationship--ceb66bd9-3e75-4559-a0b9-3339a926cde6","references":[{"source_name":"US-CERT TYPEFRAME June 2018","description":"US-CERT. (2018, June 14). MAR-10135536-12 – North Korean Trojan: TYPEFRAME. Retrieved July 13, 2018.","url":"https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"}]},{"id":"S0266","name":"TrickBot","url":"https://attack.mitre.org/software/S0266","kind":"malware","description":"[TrickBot](https://attack.mitre.org/software/S0266) can modify registry entries.(Citation: Trend Micro Trickbot Nov 2018)","relationship_id":"relationship--c75ec383-2acd-479f-b9b7-b2038ec10a7d","references":[{"source_name":"Trend Micro Trickbot Nov 2018","description":"Anthony, N., Pascual, C.. (2018, November 1). Trickbot Shows Off New Trick: Password Grabber Module. Retrieved November 16, 2018.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-shows-off-new-trick-password-grabber-module/"}]},{"id":"S0267","name":"FELIXROOT","url":"https://attack.mitre.org/software/S0267","kind":"malware","description":"[FELIXROOT](https://attack.mitre.org/software/S0267) deletes the Registry key <code>HKCU\\Software\\Classes\\Applications\\rundll32.exe\\shell\\open</code>.(Citation: FireEye FELIXROOT July 2018)","relationship_id":"relationship--321c1e2e-c295-42db-87cf-4d71f6c7f164","references":[{"source_name":"FireEye FELIXROOT July 2018","description":"Patil, S. (2018, June 26). Microsoft Office Vulnerabilities Used to Distribute FELIXROOT Backdoor in Recent Campaign. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20200607025424/https://www.fireeye.com/blog/threat-research/2018/07/microsoft-office-vulnerabilities-used-to-distribute-felixroot-backdoor.html"}]},{"id":"S0268","name":"Bisonal","url":"https://attack.mitre.org/software/S0268","kind":"malware","description":"[Bisonal](https://attack.mitre.org/software/S0268) has deleted Registry keys to clean up its prior activity.(Citation: Talos Bisonal Mar 2020) ","relationship_id":"relationship--8edfde6c-1ede-41eb-bc84-0d98fe24bebd","references":[{"source_name":"Talos Bisonal Mar 2020","description":"Mercer, W., et al. (2020, March 5). Bisonal: 10 years of play. Retrieved January 26, 2022.","url":"https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"}]},{"id":"S0269","name":"QUADAGENT","url":"https://attack.mitre.org/software/S0269","kind":"malware","description":"[QUADAGENT](https://attack.mitre.org/software/S0269) modifies an HKCU Registry key to store a session identifier unique to the compromised system as well as a pre-shared key used for encrypting and decrypting C2 communications.(Citation: Unit 42 QUADAGENT July 2018)","relationship_id":"relationship--e0999d7e-deec-446b-a86b-4c8988e20a96","references":[{"source_name":"Unit 42 QUADAGENT July 2018","description":"Lee, B., Falcone, R. (2018, July 25). OilRig Targets Technology Service Provider and Government Agency with QUADAGENT. Retrieved August 9, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/"}]},{"id":"S0271","name":"KEYMARBLE","url":"https://attack.mitre.org/software/S0271","kind":"malware","description":"[KEYMARBLE](https://attack.mitre.org/software/S0271) has a command to create Registry entries for storing data under <code>HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\WABE\\DataPath</code>.(Citation: US-CERT KEYMARBLE Aug 2018)","relationship_id":"relationship--d4f0554e-46bb-4fd5-94e8-900dfe3198cf","references":[{"source_name":"US-CERT KEYMARBLE Aug 2018","description":"US-CERT. (2018, August 09). MAR-10135536-17 – North Korean Trojan: KEYMARBLE. Retrieved August 16, 2018.","url":"https://www.us-cert.gov/ncas/analysis-reports/AR18-221A"}]},{"id":"S0330","name":"Zeus Panda","url":"https://attack.mitre.org/software/S0330","kind":"malware","description":"[Zeus Panda](https://attack.mitre.org/software/S0330) modifies several Registry keys under <code>HKCU\\Software\\Microsoft\\Internet Explorer\\ PhishingFilter\\</code> to disable phishing filters.(Citation: GDATA Zeus Panda June 2017)","relationship_id":"relationship--a9a0ecce-239c-4666-94e9-ef1fb64cf796","references":[{"source_name":"GDATA Zeus Panda June 2017","description":"Ebach, L. (2017, June 22). Analysis Results of Zeus.Variant.Panda. Retrieved November 5, 2018.","url":"https://cyberwtf.files.wordpress.com/2017/07/panda-whitepaper.pdf"}]},{"id":"S0331","name":"Agent Tesla","url":"https://attack.mitre.org/software/S0331","kind":"malware","description":"[Agent Tesla](https://attack.mitre.org/software/S0331) can achieve persistence by modifying Registry key entries.(Citation: SentinelLabs Agent Tesla Aug 2020) ","relationship_id":"relationship--d9cd513e-c863-4695-a6e0-b2e4e79c24e8","references":[{"source_name":"SentinelLabs Agent Tesla Aug 2020","description":"Walter, J. (2020, August 10). Agent Tesla | Old RAT Uses New Tricks to Stay on Top. Retrieved December 11, 2020.","url":"https://labs.sentinelone.com/agent-tesla-old-rat-uses-new-tricks-to-stay-on-top/"}]},{"id":"S0332","name":"Remcos","url":"https://attack.mitre.org/software/S0332","kind":"tool","description":"[Remcos](https://attack.mitre.org/software/S0332) has full control of the Registry, including the ability to modify it.(Citation: Riskiq Remcos Jan 2018)(Citation: Fortinet Remcos Campaign NOV 2024)","relationship_id":"relationship--66f2f7b3-3df9-4d4a-bedc-ecacac3039e8","references":[{"source_name":"Riskiq Remcos Jan 2018","description":"Klijnsma, Y. (2018, January 23). Espionage Campaign Leverages Spear Phishing, RATs Against Turkish Defense Contractors. Retrieved November 6, 2018.","url":"https://web.archive.org/web/20180124082756/https://www.riskiq.com/blog/labs/spear-phishing-turkish-defense-contractors/"},{"source_name":"Fortinet Remcos Campaign NOV 2024","description":"Zhang, X. (2024, November 8). New Campaign Uses Remcos RAT to Exploit Victims. Retrieved April 16, 2026.","url":"https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims"}]},{"id":"S0334","name":"DarkComet","url":"https://attack.mitre.org/software/S0334","kind":"malware","description":"[DarkComet](https://attack.mitre.org/software/S0334) adds a Registry value for its installation routine to the Registry Key <code>HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System Enable LUA=”0”</code> and <code>HKEY_CURRENT_USER\\Software\\DC3_FEXEC</code>.(Citation: TrendMicro DarkComet Sept 2014)(Citation: Malwarebytes DarkComet March 2018)","relationship_id":"relationship--c88e7db9-47b1-4fe9-943a-98ebde29980b","references":[{"source_name":"TrendMicro DarkComet Sept 2014","description":"TrendMicro. (2014, September 03). DARKCOMET. Retrieved November 6, 2018.","url":"https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/DARKCOMET"},{"source_name":"Malwarebytes DarkComet March 2018","description":"Kujawa, A. (2018, March 27). You dirty RAT! Part 1: DarkComet. Retrieved November 6, 2018.","url":"https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/"}]},{"id":"S0336","name":"NanoCore","url":"https://attack.mitre.org/software/S0336","kind":"malware","description":"[NanoCore](https://attack.mitre.org/software/S0336) has the capability to edit the Registry.(Citation: DigiTrust NanoCore Jan 2017)(Citation: PaloAlto NanoCore Feb 2016)","relationship_id":"relationship--a21afd42-09ae-4e6b-a065-dc1b4454216d","references":[{"source_name":"DigiTrust NanoCore Jan 2017","description":"The DigiTrust Group. (2017, January 01). NanoCore Is Not Your Average RAT. Retrieved November 9, 2018.","url":"https://www.digitrustgroup.com/nanocore-not-your-average-rat/"},{"source_name":"PaloAlto NanoCore Feb 2016","description":"Kasza, A., Halfpop, T. (2016, February 09). NanoCoreRAT Behind an Increase in Tax-Themed Phishing E-mails. Retrieved November 9, 2018.","url":"https://researchcenter.paloaltonetworks.com/2016/02/nanocorerat-behind-an-increase-in-tax-themed-phishing-e-mails/"}]},{"id":"S0342","name":"GreyEnergy","url":"https://attack.mitre.org/software/S0342","kind":"malware","description":"[GreyEnergy](https://attack.mitre.org/software/S0342) modifies conditions in the Registry and adds keys.(Citation: ESET GreyEnergy Oct 2018)","relationship_id":"relationship--b7dfc429-1f62-4bb1-933f-25dfd4fff9ad","references":[{"source_name":"ESET GreyEnergy Oct 2018","description":"Cherepanov, A. (2018, October). GREYENERGY A successor to BlackEnergy. Retrieved November 15, 2018.","url":"https://www.welivesecurity.com/wp-content/uploads/2018/10/ESET_GreyEnergy.pdf"}]},{"id":"S0343","name":"Exaramel for Windows","url":"https://attack.mitre.org/software/S0343","kind":"malware","description":"[Exaramel for Windows](https://attack.mitre.org/software/S0343) adds the configuration to the Registry in XML format.(Citation: ESET TeleBots Oct 2018)","relationship_id":"relationship--ab11615f-a0d9-43c9-b71e-6ae83155bf3b","references":[{"source_name":"ESET TeleBots Oct 2018","description":"Cherepanov, A., Lipovsky, R. (2018, October 11). New TeleBots backdoor: First evidence linking Industroyer to NotPetya. Retrieved November 27, 2018.","url":"https://www.welivesecurity.com/2018/10/11/new-telebots-backdoor-linking-industroyer-notpetya/"}]},{"id":"S0348","name":"Cardinal RAT","url":"https://attack.mitre.org/software/S0348","kind":"malware","description":"[Cardinal RAT](https://attack.mitre.org/software/S0348) sets <code>HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Load</code> to point to its executable.(Citation: PaloAlto CardinalRat Apr 2017)","relationship_id":"relationship--d7983dcd-1970-4d84-82e7-a61d2125caeb","references":[{"source_name":"PaloAlto CardinalRat Apr 2017","description":"Grunzweig, J.. (2017, April 20). Cardinal RAT Active for Over Two Years. Retrieved December 8, 2018.","url":"https://researchcenter.paloaltonetworks.com/2017/04/unit42-cardinal-rat-active-two-years/"}]},{"id":"S0350","name":"zwShell","url":"https://attack.mitre.org/software/S0350","kind":"malware","description":"[zwShell](https://attack.mitre.org/software/S0350) can modify the Registry.(Citation: McAfee Night Dragon)","relationship_id":"relationship--9fbc10b3-f72e-4cc8-9e94-34c6404c3a1f","references":[{"source_name":"McAfee Night Dragon","description":"McAfee® Foundstone® Professional Services and McAfee Labs™. (2011, February 10). Global Energy Cyberattacks: “Night Dragon”. Retrieved February 19, 2018.","url":"https://scadahacker.com/library/Documents/Cyber_Events/McAfee%20-%20Night%20Dragon%20-%20Global%20Energy%20Cyberattacks.pdf"}]},{"id":"S0356","name":"KONNI","url":"https://attack.mitre.org/software/S0356","kind":"malware","description":"[KONNI](https://attack.mitre.org/software/S0356) has modified registry keys of ComSysApp, Svchost, and xmlProv on the machine to gain persistence.(Citation: Medium KONNI Jan 2020)(Citation: Malwarebytes Konni Aug 2021) ","relationship_id":"relationship--7431e309-f379-45a5-ae7d-0520f6b17a94","references":[{"source_name":"Medium KONNI Jan 2020","description":"Karmi, D. (2020, January 4). A Look Into Konni 2019 Campaign. Retrieved April 28, 2020.","url":"https://medium.com/d-hunter/a-look-into-konni-2019-campaign-b45a0f321e9b"},{"source_name":"Malwarebytes Konni Aug 2021","description":"Threat Intelligence Team. (2021, August 23). New variant of Konni malware used in campaign targetting Russia. Retrieved January 5, 2022.","url":"https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/"}]},{"id":"S0376","name":"HOPLIGHT","url":"https://attack.mitre.org/software/S0376","kind":"malware","description":"[HOPLIGHT](https://attack.mitre.org/software/S0376) has modified Managed Object Format (MOF) files within the Registry to run specific commands and create persistence on the system.(Citation: US-CERT HOPLIGHT Apr 2019)\t","relationship_id":"relationship--0cf14628-b4c0-470a-9059-43fc562717d8","references":[{"source_name":"US-CERT HOPLIGHT Apr 2019","description":"US-CERT. (2019, April 10). MAR-10135536-8 – North Korean Trojan: HOPLIGHT. Retrieved April 19, 2019.","url":"https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"}]},{"id":"S0385","name":"njRAT","url":"https://attack.mitre.org/software/S0385","kind":"malware","description":"[njRAT](https://attack.mitre.org/software/S0385) can create, delete, or modify a specified Registry key or value.(Citation: Fidelis njRAT June 2013)(Citation: Trend Micro njRAT 2018)","relationship_id":"relationship--b2cf7d18-daa0-45a1-b2c1-6b6056bb19c4","references":[{"source_name":"Fidelis njRAT June 2013","description":"Fidelis Cybersecurity. (2013, June 28). Fidelis Threat Advisory #1009: \"njRAT\" Uncovered. Retrieved June 4, 2019.","url":"https://www.threatminer.org/_reports/2013/fta-1009---njrat-uncovered-1.pdf"},{"source_name":"Trend Micro njRAT 2018","description":"Pascual, C. (2018, November 27). AutoIt-Compiled Worm Affecting Removable Media Delivers Fileless Version of BLADABINDI/njRAT Backdoor. Retrieved June 4, 2019.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/autoit-compiled-worm-affecting-removable-media-delivers-fileless-version-of-bladabindi-njrat-backdoor/"}]},{"id":"S0386","name":"Ursnif","url":"https://attack.mitre.org/software/S0386","kind":"malware","description":"[Ursnif](https://attack.mitre.org/software/S0386) has used Registry modifications as part of its installation routine.(Citation: TrendMicro BKDR_URSNIF.SM)(Citation: ProofPoint Ursnif Aug 2016)","relationship_id":"relationship--a6252cbd-82a6-4cd6-a5f6-74507cd49f72","references":[{"source_name":"TrendMicro BKDR_URSNIF.SM","description":"Sioting, S. (2013, June 15). BKDR_URSNIF.SM. Retrieved June 5, 2019.","url":"https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/BKDR_URSNIF.SM?_ga=2.129468940.1462021705.1559742358-1202584019.1549394279"},{"source_name":"ProofPoint Ursnif Aug 2016","description":"Proofpoint Staff. (2016, August 25). Nightmare on Tor Street: Ursnif variant Dreambot adds Tor functionality. Retrieved June 5, 2019.","url":"https://www.proofpoint.com/us/threat-insight/post/ursnif-variant-dreambot-adds-tor-functionality"}]},{"id":"S0397","name":"LoJax","url":"https://attack.mitre.org/software/S0397","kind":"malware","description":"[LoJax](https://attack.mitre.org/software/S0397) has modified the Registry key <code>‘HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\BootExecute’</code> from <code>‘autocheck autochk *’</code> to <code>‘autocheck autoche *’</code>.(Citation: ESET LoJax Sept 2018)","relationship_id":"relationship--1f5c6a39-aa0b-469e-aabe-67e4d237b213","references":[{"source_name":"ESET LoJax Sept 2018","description":"ESET. (2018, September). LOJAX First UEFI rootkit found in the wild, courtesy of the Sednit group. Retrieved July 2, 2019.","url":"https://www.welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdf"}]},{"id":"S0412","name":"ZxShell","url":"https://attack.mitre.org/software/S0412","kind":"malware","description":"[ZxShell](https://attack.mitre.org/software/S0412) can create Registry entries to enable services to run.(Citation: Talos ZxShell Oct 2014)","relationship_id":"relationship--713495d9-e481-4f48-af72-e3bfd474016b","references":[{"source_name":"Talos ZxShell Oct 2014","description":"Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.","url":"https://blogs.cisco.com/security/talos/opening-zxshell"}]},{"id":"S0428","name":"PoetRAT","url":"https://attack.mitre.org/software/S0428","kind":"malware","description":"[PoetRAT](https://attack.mitre.org/software/S0428) has made registry modifications to alter its behavior upon execution.(Citation: Talos PoetRAT April 2020)","relationship_id":"relationship--2606ed25-9f1d-4e85-822a-af39ce0d8e66","references":[{"source_name":"Talos PoetRAT April 2020","description":"Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.","url":"https://blog.talosintelligence.com/2020/04/poetrat-covid-19-lures.html"}]},{"id":"S0438","name":"Attor","url":"https://attack.mitre.org/software/S0438","kind":"malware","description":"[Attor](https://attack.mitre.org/software/S0438)'s dispatcher can modify the Run registry key.(Citation: ESET Attor Oct 2019)","relationship_id":"relationship--6d39de5f-6fbd-43e3-8da8-03a4cbe46656","references":[{"source_name":"ESET Attor Oct 2019","description":"Hromcova, Z. (2019, October). AT COMMANDS, TOR-BASED COMMUNICATIONS: MEET ATTOR, A FANTASY CREATURE AND ALSO A SPY PLATFORM. Retrieved May 6, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf"}]},{"id":"S0441","name":"PowerShower","url":"https://attack.mitre.org/software/S0441","kind":"malware","description":"[PowerShower](https://attack.mitre.org/software/S0441) has added a registry key so future powershell.exe instances are spawned off-screen by default, and has removed all registry entries that are left behind during the dropper process.(Citation: Unit 42 Inception November 2018)","relationship_id":"relationship--a679be02-156a-4e02-bfa5-ce07b60d147b","references":[{"source_name":"Unit 42 Inception November 2018","description":"Lancaster, T. (2018, November 5). Inception Attackers Target Europe with Year-old Office Vulnerability. Retrieved May 8, 2020.","url":"https://unit42.paloaltonetworks.com/unit42-inception-attackers-target-europe-year-old-office-vulnerability/"}]},{"id":"S0444","name":"ShimRat","url":"https://attack.mitre.org/software/S0444","kind":"malware","description":"[ShimRat](https://attack.mitre.org/software/S0444) has registered two registry keys for shim databases.(Citation: FOX-IT May 2016 Mofang)","relationship_id":"relationship--f81b567d-9fd3-44f4-bd6b-9ba6f386609e","references":[{"source_name":"FOX-IT May 2016 Mofang","description":"Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.","url":"https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"}]},{"id":"S0447","name":"Lokibot","url":"https://attack.mitre.org/software/S0447","kind":"malware","description":"[Lokibot](https://attack.mitre.org/software/S0447) has modified the Registry as part of its UAC bypass process.(Citation: Talos Lokibot Jan 2021) ","relationship_id":"relationship--710919f6-2c74-4f41-be51-af848ad691af","references":[{"source_name":"Talos Lokibot Jan 2021","description":"Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.","url":"https://blog.talosintelligence.com/2021/01/a-deep-dive-into-lokibot-infection-chain.html"}]},{"id":"S0455","name":"Metamorfo","url":"https://attack.mitre.org/software/S0455","kind":"malware","description":"[Metamorfo](https://attack.mitre.org/software/S0455) has written process names to the Registry, disabled IE browser features, deleted Registry keys, and changed the ExtendedUIHoverTime key.(Citation: Medium Metamorfo Apr 2020)(Citation: Fortinet Metamorfo Feb 2020)(Citation: FireEye Metamorfo Apr 2018)(Citation: ESET Casbaneiro Oct 2019)","relationship_id":"relationship--676c5a2a-323b-4166-9c83-8c6e5e25bb1f","references":[{"source_name":"Medium Metamorfo Apr 2020","description":"Erlich, C. (2020, April 3). The Avast Abuser: Metamorfo Banking Malware Hides By Abusing Avast Executable. Retrieved May 26, 2020.","url":"https://medium.com/@chenerlich/the-avast-abuser-metamorfo-banking-malware-hides-by-abusing-avast-executable-ac9b8b392767"},{"source_name":"Fortinet Metamorfo Feb 2020","description":"Zhang, X. (2020, February 4). Another Metamorfo Variant Targeting Customers of Financial Institutions in More Countries. Retrieved July 30, 2020.","url":"https://www.fortinet.com/blog/threat-research/another-metamorfo-variant-targeting-customers-of-financial-institutions"},{"source_name":"FireEye Metamorfo Apr 2018","description":"Sierra, E., Iglesias, G.. (2018, April 24). Metamorfo Campaigns Targeting Brazilian Users. Retrieved July 30, 2020.","url":"https://www.fireeye.com/blog/threat-research/2018/04/metamorfo-campaign-targeting-brazilian-users.html"},{"source_name":"ESET Casbaneiro Oct 2019","description":"ESET Research. (2019, October 3). Casbaneiro: peculiarities of this banking Trojan that affects Brazil and Mexico. Retrieved September 23, 2021.","url":"https://www.welivesecurity.com/2019/10/03/casbaneiro-trojan-dangerous-cooking/"}]},{"id":"S0457","name":"Netwalker","url":"https://attack.mitre.org/software/S0457","kind":"malware","description":"[Netwalker](https://attack.mitre.org/software/S0457) can add the following registry entry: <code>HKEY_CURRENT_USER\\SOFTWARE\\{8 random characters}</code>.(Citation: TrendMicro Netwalker May 2020)","relationship_id":"relationship--0775a1ba-c95a-472e-ab1c-d21108acc907","references":[{"source_name":"TrendMicro Netwalker May 2020","description":"Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/netwalker-fileless-ransomware-injected-via-reflective-loading/"}]},{"id":"S0467","name":"TajMahal","url":"https://attack.mitre.org/software/S0467","kind":"malware","description":"[TajMahal](https://attack.mitre.org/software/S0467) can set the <code>KeepPrintedJobs</code> attribute for configured printers in <code>SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Print\\\\Printers</code> to enable document stealing.(Citation: Kaspersky TajMahal April 2019)","relationship_id":"relationship--91c175b7-5c8e-4534-82b1-9bdb1b709a34","references":[{"source_name":"Kaspersky TajMahal April 2019","description":"GReAT. (2019, April 10). Project TajMahal – a sophisticated new APT framework. Retrieved October 14, 2019.","url":"https://securelist.com/project-tajmahal/90240/"}]},{"id":"S0476","name":"Valak","url":"https://attack.mitre.org/software/S0476","kind":"malware","description":"[Valak](https://attack.mitre.org/software/S0476) has the ability to modify the Registry key <code>HKCU\\Software\\ApplicationContainer\\Appsw64</code> to store information regarding the C2 server and downloads.(Citation: Cybereason Valak May 2020)(Citation: Unit 42 Valak July 2020)(Citation: SentinelOne Valak June 2020)","relationship_id":"relationship--0841cd91-1151-411f-befc-0204e3a3eb30","references":[{"source_name":"Unit 42 Valak July 2020","description":"Duncan, B. (2020, July 24). Evolution of Valak, from Its Beginnings to Mass Distribution. Retrieved August 31, 2020.","url":"https://unit42.paloaltonetworks.com/valak-evolution/"},{"source_name":"SentinelOne Valak June 2020","description":"Reaves, J. and Platt, J. (2020, June). Valak Malware and the Connection to Gozi Loader ConfCrew. Retrieved August 31, 2020.","url":"https://assets.sentinelone.com/labs/sentinel-one-valak-i"},{"source_name":"Cybereason Valak May 2020","description":"Salem, E. et al. (2020, May 28). VALAK: MORE THAN MEETS THE EYE . Retrieved June 19, 2020.","url":"https://www.cybereason.com/blog/valak-more-than-meets-the-eye"}]},{"id":"S0488","name":"CrackMapExec","url":"https://attack.mitre.org/software/S0488","kind":"tool","description":"[CrackMapExec](https://attack.mitre.org/software/S0488) can create a registry key using wdigest.(Citation: CME Github September 2018)","relationship_id":"relationship--99eab281-6555-4aee-9d83-0e97bb3262ef","references":[{"source_name":"CME Github September 2018","description":"byt3bl33d3r. (2018, September 8). SMB: Command Reference. Retrieved July 17, 2020.","url":"https://github.com/byt3bl33d3r/CrackMapExec/wiki/SMB-Command-Reference"}]},{"id":"S0496","name":"REvil","url":"https://attack.mitre.org/software/S0496","kind":"malware","description":"[REvil](https://attack.mitre.org/software/S0496) can modify the Registry to save encryption parameters and system information.(Citation: Cylance Sodinokibi July 2019)(Citation: Secureworks GandCrab and REvil September 2019)(Citation: McAfee Sodinokibi October 2019)(Citation: Intel 471 REvil March 2020)(Citation: Secureworks REvil September 2019)","relationship_id":"relationship--2c927351-d98a-4734-83db-82ad3231e59f","references":[{"source_name":"Secureworks REvil September 2019","description":"Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020.","url":"https://www.secureworks.com/research/revil-sodinokibi-ransomware"},{"source_name":"Cylance Sodinokibi July 2019","description":"Cylance. (2019, July 3). hreat Spotlight: Sodinokibi Ransomware. Retrieved August 4, 2020.","url":"https://threatvector.cylance.com/en_us/home/threat-spotlight-sodinokibi-ransomware.html"},{"source_name":"Intel 471 REvil March 2020","description":"Intel 471 Malware Intelligence team. (2020, March 31). REvil Ransomware-as-a-Service – An analysis of a ransomware affiliate operation. Retrieved August 4, 2020.","url":"https://intel471.com/blog/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation/"},{"source_name":"McAfee Sodinokibi October 2019","description":"McAfee. (2019, October 2). McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – What The Code Tells Us. Retrieved August 4, 2020.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/"},{"source_name":"Secureworks GandCrab and REvil September 2019","description":"Secureworks . (2019, September 24). REvil: The GandCrab Connection. Retrieved August 4, 2020.","url":"https://www.secureworks.com/blog/revil-the-gandcrab-connection"}]},{"id":"S0501","name":"PipeMon","url":"https://attack.mitre.org/software/S0501","kind":"malware","description":"[PipeMon](https://attack.mitre.org/software/S0501) has modified the Registry to store its encrypted payload.(Citation: ESET PipeMon May 2020)","relationship_id":"relationship--33823f15-f43f-41ef-bc14-7dea2ab21acf","references":[{"source_name":"ESET PipeMon May 2020","description":"Tartare, M. et al. (2020, May 21). No “Game over” for the Winnti Group. Retrieved August 24, 2020.","url":"https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/"}]},{"id":"S0511","name":"RegDuke","url":"https://attack.mitre.org/software/S0511","kind":"malware","description":"[RegDuke](https://attack.mitre.org/software/S0511) can create seemingly legitimate Registry key to store its encryption key.(Citation: ESET Dukes October 2019)","relationship_id":"relationship--87630bba-4308-46f2-9601-7d30795a2eb6","references":[{"source_name":"ESET Dukes October 2019","description":"Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"}]},{"id":"S0517","name":"Pillowmint","url":"https://attack.mitre.org/software/S0517","kind":"malware","description":"[Pillowmint](https://attack.mitre.org/software/S0517) has modified the Registry key <code>HKLM\\SOFTWARE\\Microsoft\\DRM</code> to store a malicious payload.(Citation: Trustwave Pillowmint June 2020)","relationship_id":"relationship--332ce4cd-311a-457f-ae10-6d8e3ef7bc77","references":[{"source_name":"Trustwave Pillowmint June 2020","description":"Trustwave SpiderLabs. (2020, June 22). Pillowmint: FIN7’s Monkey Thief . Retrieved July 27, 2020.","url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/pillowmint-fin7s-monkey-thief/"}]},{"id":"S0518","name":"PolyglotDuke","url":"https://attack.mitre.org/software/S0518","kind":"malware","description":"[PolyglotDuke](https://attack.mitre.org/software/S0518) can write encrypted JSON configuration files to the Registry.(Citation: ESET Dukes October 2019)","relationship_id":"relationship--190057d5-13ad-40d2-a2f0-0177850e2905","references":[{"source_name":"ESET Dukes October 2019","description":"Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"}]},{"id":"S0527","name":"CSPY Downloader","url":"https://attack.mitre.org/software/S0527","kind":"tool","description":"[CSPY Downloader](https://attack.mitre.org/software/S0527) can write to the Registry under the <code>%windir%</code> variable to execute tasks.(Citation: Cybereason Kimsuky November 2020)","relationship_id":"relationship--4d58ff48-b6d8-48ba-aa29-2f34d4dc1264","references":[{"source_name":"Cybereason Kimsuky November 2020","description":"Dahan, A. et al. (2020, November 2). Back to the Future: Inside the Kimsuky KGH Spyware Suite. Retrieved November 6, 2020.","url":"https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite"}]},{"id":"S0531","name":"Grandoreiro","url":"https://attack.mitre.org/software/S0531","kind":"malware","description":"[Grandoreiro](https://attack.mitre.org/software/S0531) can modify the Registry to store its configuration at `HKCU\\Software\\` under frequently changing names including <code>%USERNAME%</code> and <code>ToolTech-RM</code>.(Citation: ESET Grandoreiro April 2020)","relationship_id":"relationship--2e53dad4-17cc-4fe6-a3b9-d622075d78f7","references":[{"source_name":"ESET Grandoreiro April 2020","description":"ESET. (2020, April 28). Grandoreiro: How engorged can an EXE get?. Retrieved November 13, 2020.","url":"https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/"}]},{"id":"S0533","name":"SLOTHFULMEDIA","url":"https://attack.mitre.org/software/S0533","kind":"malware","description":"[SLOTHFULMEDIA](https://attack.mitre.org/software/S0533) can add, modify, and/or delete registry keys. It has changed the proxy configuration of a victim system by modifying the <code>HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap</code> registry.(Citation: CISA MAR SLOTHFULMEDIA October 2020)","relationship_id":"relationship--10fb2420-a482-4909-90c6-fd9f7e5c24a6","references":[{"source_name":"CISA MAR SLOTHFULMEDIA October 2020","description":"DHS/CISA, Cyber National Mission Force. (2020, October 1). Malware Analysis Report (MAR) MAR-10303705-1.v1 – Remote Access Trojan: SLOTHFULMEDIA. Retrieved October 2, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a"}]},{"id":"S0537","name":"HyperStack","url":"https://attack.mitre.org/software/S0537","kind":"malware","description":"[HyperStack](https://attack.mitre.org/software/S0537) can add the name of its communication pipe to <code>HKLM\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\lanmanserver\\\\parameters\\NullSessionPipes</code>.(Citation: Accenture HyperStack October 2020)","relationship_id":"relationship--91f7282f-e496-462d-9fd5-6cf4d0170e91","references":[{"source_name":"Accenture HyperStack October 2020","description":"Accenture. (2020, October). Turla uses HyperStack, Carbon, and Kazuar to compromise government entity. Retrieved December 2, 2020.","url":"https://web.archive.org/web/20201101015247/https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity"}]},{"id":"S0559","name":"SUNBURST","url":"https://attack.mitre.org/software/S0559","kind":"malware","description":"[SUNBURST](https://attack.mitre.org/software/S0559) had commands that allow an attacker to write or delete registry keys, and was observed stopping services by setting their <code>HKLM\\SYSTEM\\CurrentControlSet\\services\\\\[service_name]\\\\Start</code> registry entries to value 4.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: Microsoft Analyzing Solorigate Dec 2020) It also deleted previously-created Image File Execution Options (IFEO) Debugger registry values and registry keys related to HTTP proxy to clean up traces of its activity.(Citation: Microsoft Deep Dive Solorigate January 2021)","relationship_id":"relationship--15cd99f1-29b4-4603-ae74-fdc204afead4","references":[{"source_name":"FireEye SUNBURST Backdoor December 2020","description":"FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021.","url":"https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"},{"source_name":"Microsoft Analyzing Solorigate Dec 2020","description":"MSTIC. (2020, December 18). Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect customers . Retrieved January 5, 2021.","url":"https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/"},{"source_name":"Microsoft Deep Dive Solorigate January 2021","description":"MSTIC, CDOC, 365 Defender Research Team. (2021, January 20). Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop . Retrieved January 22, 2021.","url":"https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/"}]},{"id":"S0560","name":"TEARDROP","url":"https://attack.mitre.org/software/S0560","kind":"malware","description":"[TEARDROP](https://attack.mitre.org/software/S0560) modified the Registry to create a Windows service for itself on a compromised host.(Citation: Check Point Sunburst Teardrop December 2020)","relationship_id":"relationship--69356661-76fb-46fe-94ce-d029ee7f8a64","references":[{"source_name":"Check Point Sunburst Teardrop December 2020","description":"Check Point Research. (2020, December 22). SUNBURST, TEARDROP and the NetSec New Normal. Retrieved January 6, 2021.","url":"https://research.checkpoint.com/2020/sunburst-teardrop-and-the-netsec-new-normal/"}]},{"id":"S0568","name":"EVILNUM","url":"https://attack.mitre.org/software/S0568","kind":"malware","description":"[EVILNUM](https://attack.mitre.org/software/S0568) can make modifications to the Regsitry for persistence.(Citation: Prevailion EvilNum May 2020)","relationship_id":"relationship--a7c6693e-d1e2-4396-982f-85978c9b97a3","references":[{"source_name":"Prevailion EvilNum May 2020","description":"Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20221209052853/https://www.prevailion.com/phantom-in-the-command-shell-2/"}]},{"id":"S0569","name":"Explosive","url":"https://attack.mitre.org/software/S0569","kind":"malware","description":"[Explosive](https://attack.mitre.org/software/S0569) has a function to write itself to Registry values.(Citation: CheckPoint Volatile Cedar March 2015) ","relationship_id":"relationship--178116a9-6ac9-45c0-bc74-36fe9ba12686","references":[{"source_name":"CheckPoint Volatile Cedar March 2015","description":"Threat Intelligence and Research. (2015, March 30). VOLATILE CEDAR. Retrieved February 8, 2021.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/03/20082004/volatile-cedar-technical-report.pdf"}]},{"id":"S0570","name":"BitPaymer","url":"https://attack.mitre.org/software/S0570","kind":"malware","description":"[BitPaymer](https://attack.mitre.org/software/S0570) can set values in the Registry to help in execution.(Citation: Crowdstrike Indrik November 2018) ","relationship_id":"relationship--e811f6e8-a736-4bb8-8cd9-c6edc9a7ebd8","references":[{"source_name":"Crowdstrike Indrik November 2018","description":"Frankoff, S., Hartley, B. (2018, November 14). Big Game Hunting: The Evolution of INDRIK SPIDER From Dridex Wire Fraud to BitPaymer Targeted Ransomware. Retrieved January 6, 2021.","url":"https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/"}]},{"id":"S0572","name":"Caterpillar WebShell","url":"https://attack.mitre.org/software/S0572","kind":"malware","description":"[Caterpillar WebShell](https://attack.mitre.org/software/S0572) has a command to modify a Registry key.(Citation: ClearSky Lebanese Cedar Jan 2021)","relationship_id":"relationship--8ecc61b0-c0b9-4f3a-a6b4-53c88e1d9bb7","references":[{"source_name":"ClearSky Lebanese Cedar Jan 2021","description":"ClearSky Cyber Security. (2021, January). “Lebanese Cedar” APT Global Lebanese Espionage Campaign Leveraging Web Servers. Retrieved February 10, 2021.","url":"https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf"}]},{"id":"S0576","name":"MegaCortex","url":"https://attack.mitre.org/software/S0576","kind":"malware","description":"[MegaCortex](https://attack.mitre.org/software/S0576) has added entries to the Registry for ransom contact information.(Citation: IBM MegaCortex)","relationship_id":"relationship--83d63b2b-f287-4047-bbe4-82c8b100222a","references":[{"source_name":"IBM MegaCortex","description":"Del Fierro, C. Kessem, L.. (2020, January 8). From Mega to Giga: Cross-Version Comparison of Top MegaCortex Modifications. Retrieved February 15, 2021.","url":"https://securityintelligence.com/posts/from-mega-to-giga-cross-version-comparison-of-top-megacortex-modifications/"}]},{"id":"S0579","name":"Waterbear","url":"https://attack.mitre.org/software/S0579","kind":"malware","description":"[Waterbear](https://attack.mitre.org/software/S0579) has deleted certain values from the Registry to load a malicious DLL.(Citation: Trend Micro Waterbear December 2019) ","relationship_id":"relationship--631ba90c-982c-4415-a13c-75cf06e53252","references":[{"source_name":"Trend Micro Waterbear December 2019","description":"Su, V. et al. (2019, December 11). Waterbear Returns, Uses API Hooking to Evade Security. Retrieved February 22, 2021.","url":"https://www.trendmicro.com/en_us/research/19/l/waterbear-is-back-uses-api-hooking-to-evade-security-product-detection.html"}]},{"id":"S0583","name":"Pysa","url":"https://attack.mitre.org/software/S0583","kind":"malware","description":"[Pysa](https://attack.mitre.org/software/S0583) has modified the registry key “SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System” and added the ransom note.(Citation: CERT-FR PYSA April 2020) ","relationship_id":"relationship--7a097ec6-c379-4aef-849e-fe7d9ea1e7d1","references":[{"source_name":"CERT-FR PYSA April 2020","description":"CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.","url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-003.pdf"}]},{"id":"S0589","name":"Sibot","url":"https://attack.mitre.org/software/S0589","kind":"malware","description":"[Sibot](https://attack.mitre.org/software/S0589) has modified the Registry to install a second-stage script in the <code>HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\sibot</code>.(Citation: MSTIC NOBELIUM Mar 2021)","relationship_id":"relationship--e41eea8b-20d6-4050-96e6-6b59670f6e65","references":[{"source_name":"MSTIC NOBELIUM Mar 2021","description":"Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.","url":"https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/"}]},{"id":"S0596","name":"ShadowPad","url":"https://attack.mitre.org/software/S0596","kind":"malware","description":"[ShadowPad](https://attack.mitre.org/software/S0596) can modify the Registry to store and maintain a configuration block and virtual file system.(Citation: Kaspersky ShadowPad Aug 2017)(Citation: TrendMicro EarthLusca 2022)","relationship_id":"relationship--072c3b1d-1ad6-447e-9512-2c6bc6e797fd","references":[{"source_name":"TrendMicro EarthLusca 2022","description":"Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"},{"source_name":"Kaspersky ShadowPad Aug 2017","description":"Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2017/08/07172148/ShadowPad_technical_description_PDF.pdf"}]},{"id":"S0603","name":"Stuxnet","url":"https://attack.mitre.org/software/S0603","kind":"malware","description":"[Stuxnet](https://attack.mitre.org/software/S0603) can create registry keys to load driver files.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)","relationship_id":"relationship--2f11e661-a5a0-4420-b97e-b080fc4fa441","references":[{"source_name":"Nicolas Falliere, Liam O Murchu, Eric Chien February 2011","description":"Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.","url":"https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"}]},{"id":"S0608","name":"Conficker","url":"https://attack.mitre.org/software/S0608","kind":"malware","description":"[Conficker](https://attack.mitre.org/software/S0608) adds keys to the Registry at <code>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services</code> and various other Registry locations.(Citation: SANS Conficker)(Citation: Trend Micro Conficker)","relationship_id":"relationship--150667a8-2155-4500-b7bb-c2d6bbc568b8","references":[{"source_name":"SANS Conficker","description":"Burton, K. (n.d.). The Conficker Worm. Retrieved February 18, 2021.","url":"https://web.archive.org/web/20200125132645/https://www.sans.org/security-resources/malwarefaq/conficker-worm"},{"source_name":"Trend Micro Conficker","description":"Trend Micro. (2014, March 18). Conficker. Retrieved February 18, 2021.","url":"https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/conficker"}]},{"id":"S0611","name":"Clop","url":"https://attack.mitre.org/software/S0611","kind":"malware","description":"[Clop](https://attack.mitre.org/software/S0611) can make modifications to Registry keys.(Citation: Cybereason Clop Dec 2020) ","relationship_id":"relationship--a5c59466-b7ac-44a0-804d-cdfbc88c8fba","references":[{"source_name":"Cybereason Clop Dec 2020","description":"Cybereason Nocturnus. (2020, December 23). Cybereason vs. Clop Ransomware. Retrieved May 11, 2021.","url":"https://www.cybereason.com/blog/cybereason-vs.-clop-ransomware"}]},{"id":"S0612","name":"WastedLocker","url":"https://attack.mitre.org/software/S0612","kind":"malware","description":"[WastedLocker](https://attack.mitre.org/software/S0612) can modify registry values within the <code>Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap</code> registry key.(Citation: NCC Group WastedLocker June 2020)","relationship_id":"relationship--519beaec-1b79-42d7-9739-8c22e896e0cd","references":[{"source_name":"NCC Group WastedLocker June 2020","description":"Antenucci, S., Pantazopoulos, N., Sandee, M. (2020, June 23). WastedLocker: A New Ransomware Variant Developed By The Evil Corp Group. Retrieved September 14, 2021.","url":"https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/"}]},{"id":"S0631","name":"Chaes","url":"https://attack.mitre.org/software/S0631","kind":"malware","description":"[Chaes](https://attack.mitre.org/software/S0631) can modify Registry values to stored information and establish persistence.(Citation: Cybereason Chaes Nov 2020) ","relationship_id":"relationship--9fde7504-bd24-46f5-88d7-4afcb8d37f4a","references":[{"source_name":"Cybereason Chaes Nov 2020","description":"Salem, E. (2020, November 17). CHAES: Novel Malware Targeting Latin American E-Commerce. Retrieved June 30, 2021.","url":"https://www.cybereason.com/hubfs/dam/collateral/reports/11-2020-Chaes-e-commerce-malware-research.pdf"}]},{"id":"S0640","name":"Avaddon","url":"https://attack.mitre.org/software/S0640","kind":"malware","description":"[Avaddon](https://attack.mitre.org/software/S0640) modifies several registry keys for persistence and UAC bypass.(Citation: Arxiv Avaddon Feb 2021)","relationship_id":"relationship--c27ceec5-2eaf-4b3b-8120-9fb691d6458b","references":[{"source_name":"Arxiv Avaddon Feb 2021","description":"Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.","url":"https://arxiv.org/pdf/2102.04796.pdf"}]},{"id":"S0649","name":"SMOKEDHAM","url":"https://attack.mitre.org/software/S0649","kind":"malware","description":"[SMOKEDHAM](https://attack.mitre.org/software/S0649) has modified registry keys for persistence, to enable credential caching for credential access, and to facilitate lateral movement via RDP.(Citation: FireEye SMOKEDHAM June 2021)","relationship_id":"relationship--331f7990-d817-49ec-9d55-c4c64da7f4a6","references":[{"source_name":"FireEye SMOKEDHAM June 2021","description":"FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.","url":"https://www.fireeye.com/blog/threat-research/2021/06/darkside-affiliate-supply-chain-software-compromise.html"}]},{"id":"S0650","name":"QakBot","url":"https://attack.mitre.org/software/S0650","kind":"malware","description":"[QakBot](https://attack.mitre.org/software/S0650) can modify the Registry to store its configuration information in a randomly named subkey under <code>HKCU\\Software\\Microsoft</code>.(Citation: Red Canary Qbot)(Citation: Group IB Ransomware September 2020)","relationship_id":"relationship--c039483a-5e0f-47be-b614-0d766eda9e0f","references":[{"source_name":"Group IB Ransomware September 2020","description":"Group IB. (2020, September). LOCK LIKE  A PRO. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20220119114433/https://groupib.pathfactory.com/ransomware-reports/prolock_wp"},{"source_name":"Red Canary Qbot","description":"Rainey, K. (n.d.). Qbot. Retrieved September 27, 2021.","url":"https://redcanary.com/threat-detection-report/threats/qbot/"}]},{"id":"S0660","name":"Clambling","url":"https://attack.mitre.org/software/S0660","kind":"malware","description":"[Clambling](https://attack.mitre.org/software/S0660) can set and delete Registry keys.(Citation: Trend Micro DRBControl February 2020)","relationship_id":"relationship--bef96df2-cc94-414d-8144-4c4875c59751","references":[{"source_name":"Trend Micro DRBControl February 2020","description":"Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}]},{"id":"S0662","name":"RCSession","url":"https://attack.mitre.org/software/S0662","kind":"malware","description":"[RCSession](https://attack.mitre.org/software/S0662) can write its configuration file to the Registry.(Citation: Trend Micro DRBControl February 2020)(Citation: Profero APT27 December 2020)","relationship_id":"relationship--ec72af45-d362-41c1-99d1-7a225a823049","references":[{"source_name":"Profero APT27 December 2020","description":"Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.","url":"https://web.archive.org/web/20210104144857/https://shared-public-reports.s3-eu-west-1.amazonaws.com/APT27+turns+to+ransomware.pdf"},{"source_name":"Trend Micro DRBControl February 2020","description":"Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}]},{"id":"S0663","name":"SysUpdate","url":"https://attack.mitre.org/software/S0663","kind":"malware","description":"[SysUpdate](https://attack.mitre.org/software/S0663) can write its configuration file to <code>Software\\Classes\\scConfig</code> in either <code>HKEY_LOCAL_MACHINE</code> or <code>HKEY_CURRENT_USER</code>.(Citation: Trend Micro Iron Tiger April 2021)","relationship_id":"relationship--b01341a2-dacf-4780-acf9-3325f8597409","references":[{"source_name":"Trend Micro Iron Tiger April 2021","description":"Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021.","url":"https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"}]},{"id":"S0664","name":"Pandora","url":"https://attack.mitre.org/software/S0664","kind":"malware","description":"[Pandora](https://attack.mitre.org/software/S0664) can write an encrypted token to the Registry to enable processing of remote commands.(Citation: Trend Micro Iron Tiger April 2021)","relationship_id":"relationship--ff495a54-08f1-4b0f-b44d-6bbeb5240225","references":[{"source_name":"Trend Micro Iron Tiger April 2021","description":"Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021.","url":"https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"}]},{"id":"S0665","name":"ThreatNeedle","url":"https://attack.mitre.org/software/S0665","kind":"malware","description":"[ThreatNeedle](https://attack.mitre.org/software/S0665) can modify the Registry to save its configuration data as the following RC4-encrypted Registry key: `HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\GameCon`.(Citation: Kaspersky ThreatNeedle Feb 2021)","relationship_id":"relationship--a5f5eee7-6cc2-4eb4-b918-fc771b927abc","references":[{"source_name":"Kaspersky ThreatNeedle Feb 2021","description":"Vyacheslav Kopeytsev and Seongsu Park. (2021, February 25). Lazarus targets defense industry with ThreatNeedle. Retrieved October 27, 2021.","url":"https://securelist.com/lazarus-threatneedle/100803/"}]},{"id":"S0666","name":"Gelsemium","url":"https://attack.mitre.org/software/S0666","kind":"malware","description":"[Gelsemium](https://attack.mitre.org/software/S0666) can modify the Registry to store its components.(Citation: ESET Gelsemium June 2021)","relationship_id":"relationship--516712db-0e82-43a5-bd9f-f1a4cb4939c1","references":[{"source_name":"ESET Gelsemium June 2021","description":"Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.","url":"https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"}]},{"id":"S0668","name":"TinyTurla","url":"https://attack.mitre.org/software/S0668","kind":"malware","description":"[TinyTurla](https://attack.mitre.org/software/S0668) can set its configuration parameters in the Registry.(Citation: Talos TinyTurla September 2021)","relationship_id":"relationship--2f603550-4368-4f34-89d9-50f69eed2fa9","references":[{"source_name":"Talos TinyTurla September 2021","description":"Cisco Talos. (2021, September 21). TinyTurla - Turla deploys new malware to keep a secret backdoor on victim machines. Retrieved December 2, 2021.","url":"https://blog.talosintelligence.com/2021/09/tinyturla.html"}]},{"id":"S0669","name":"KOCTOPUS","url":"https://attack.mitre.org/software/S0669","kind":"malware","description":"[KOCTOPUS](https://attack.mitre.org/software/S0669) has added and deleted keys from the Registry.(Citation: MalwareBytes LazyScripter Feb 2021)","relationship_id":"relationship--1aae3796-86d5-4b31-ad21-e1dcc508a3b5","references":[{"source_name":"MalwareBytes LazyScripter Feb 2021","description":"Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}]},{"id":"S0670","name":"WarzoneRAT","url":"https://attack.mitre.org/software/S0670","kind":"malware","description":"[WarzoneRAT](https://attack.mitre.org/software/S0670) can create `HKCU\\Software\\Classes\\Folder\\shell\\open\\command` as a new registry key during privilege escalation.(Citation: Uptycs Warzone UAC Bypass November 2020)(Citation: Check Point Warzone Feb 2020) ","relationship_id":"relationship--42a2aec6-4efb-44d0-8ae8-32a208c05da6","references":[{"source_name":"Check Point Warzone Feb 2020","description":"Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.","url":"https://research.checkpoint.com/2020/warzone-behind-the-enemy-lines/"},{"source_name":"Uptycs Warzone UAC Bypass November 2020","description":"Mohanta, A. (2020, November 25). Warzone RAT comes with UAC bypass technique. Retrieved April 7, 2022.","url":"https://www.uptycs.com/blog/warzone-rat-comes-with-uac-bypass-technique"}]},{"id":"S0673","name":"DarkWatchman","url":"https://attack.mitre.org/software/S0673","kind":"malware","description":"[DarkWatchman](https://attack.mitre.org/software/S0673) can modify Registry values to store configuration strings, keylogger, and output of components.(Citation: Prevailion DarkWatchman 2021)","relationship_id":"relationship--2e126b9a-f902-4077-963e-64185c9544ff","references":[{"source_name":"Prevailion DarkWatchman 2021","description":"Smith, S., Stafford, M. (2021, December 14). DarkWatchman: A new evolution in fileless techniques. Retrieved January 10, 2022.","url":"https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/"}]},{"id":"S0674","name":"CharmPower","url":"https://attack.mitre.org/software/S0674","kind":"malware","description":"[CharmPower](https://attack.mitre.org/software/S0674) can remove persistence-related artifacts from the Registry.(Citation: Check Point APT35 CharmPower January 2022)","relationship_id":"relationship--0167fba6-d37d-46ba-bb07-5fc70b864b3f","references":[{"source_name":"Check Point APT35 CharmPower January 2022","description":"Check Point. (2022, January 11). APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit. Retrieved January 24, 2022.","url":"https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/"}]},{"id":"S0677","name":"AADInternals","url":"https://attack.mitre.org/software/S0677","kind":"tool","description":"[AADInternals](https://attack.mitre.org/software/S0677) can modify registry keys as part of setting a new pass-through authentication agent.(Citation: AADInternals Documentation)","relationship_id":"relationship--faa657c6-e223-4b45-8f92-b35fbd76bd56","references":[{"source_name":"AADInternals Documentation","description":"Dr. Nestori Syynimaa. (2018, October 25). AADInternals. Retrieved February 18, 2022.","url":"https://o365blog.com/aadinternals"}]},{"id":"S0679","name":"Ferocious","url":"https://attack.mitre.org/software/S0679","kind":"malware","description":"[Ferocious](https://attack.mitre.org/software/S0679) has the ability to add a Class ID in the current user Registry hive to enable persistence mechanisms.(Citation: Kaspersky WIRTE November 2021)","relationship_id":"relationship--d52b8760-abba-46f0-8c82-653b95cb2775","references":[{"source_name":"Kaspersky WIRTE November 2021","description":"Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.","url":"https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044"}]},{"id":"S0691","name":"Neoichor","url":"https://attack.mitre.org/software/S0691","kind":"malware","description":"[Neoichor](https://attack.mitre.org/software/S0691) has the ability to configure browser settings by modifying Registry entries under `HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer`.(Citation: Microsoft NICKEL December 2021)","relationship_id":"relationship--8c29eb34-02dd-42c8-9324-bfad5cde2fc7","references":[{"source_name":"Microsoft NICKEL December 2021","description":"MSTIC. (2021, December 6). NICKEL targeting government organizations across Latin America and Europe. Retrieved March 18, 2022.","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}]},{"id":"S0692","name":"SILENTTRINITY","url":"https://attack.mitre.org/software/S0692","kind":"tool","description":"[SILENTTRINITY](https://attack.mitre.org/software/S0692) can modify registry keys, including to enable or disable Remote Desktop Protocol (RDP).(Citation: GitHub SILENTTRINITY Modules July 2019)","relationship_id":"relationship--60202ca3-cadc-4756-99c8-a4b18e07d116","references":[{"source_name":"GitHub SILENTTRINITY Modules July 2019","description":"Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022.","url":"https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo"}]},{"id":"S0697","name":"HermeticWiper","url":"https://attack.mitre.org/software/S0697","kind":"malware","description":"[HermeticWiper](https://attack.mitre.org/software/S0697) has the ability to modify Registry keys to disable crash dumps, colors for compressed files, and pop-up information about folders and desktop items.(Citation: SentinelOne Hermetic Wiper February 2022)(Citation: Crowdstrike DriveSlayer February 2022)(Citation: Qualys Hermetic Wiper March 2022)","relationship_id":"relationship--41de9761-477c-4674-aea7-64a0b0b4ab4b","references":[{"source_name":"SentinelOne Hermetic Wiper February 2022","description":"Guerrero-Saade, J. (2022, February 23). HermeticWiper | New Destructive Malware Used In Cyber Attacks on Ukraine. Retrieved March 25, 2022.","url":"https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack"},{"source_name":"Crowdstrike DriveSlayer February 2022","description":"Thomas, W. et al. (2022, February 25). CrowdStrike Falcon Protects from New Wiper Malware Used in Ukraine Cyberattacks. Retrieved March 25, 2022.","url":"https://www.crowdstrike.com/blog/how-crowdstrike-falcon-protects-against-wiper-malware-used-in-ukraine-attacks/"},{"source_name":"Qualys Hermetic Wiper March 2022","description":"Dani, M. (2022, March 1). Ukrainian Targets Hit by HermeticWiper, New Datawiper Malware. Retrieved March 25, 2022.","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/03/01/ukrainian-targets-hit-by-hermeticwiper-new-datawiper-malware"}]},{"id":"S1011","name":"Tarrask","url":"https://attack.mitre.org/software/S1011","kind":"malware","description":"[Tarrask](https://attack.mitre.org/software/S1011) is able to delete the Security Descriptor (`SD`) registry subkey in order to “hide” scheduled tasks.(Citation: Tarrask scheduled task)","relationship_id":"relationship--8eb5293f-e310-429c-a801-596feb3903a0","references":[{"source_name":"Tarrask scheduled task","description":"Microsoft Threat Intelligence Team & Detection and Response Team . (2022, April 12). Tarrask malware uses scheduled tasks for defense evasion. Retrieved June 1, 2022.","url":"https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/"}]},{"id":"S1025","name":"Amadey","url":"https://attack.mitre.org/software/S1025","kind":"malware","description":"[Amadey](https://attack.mitre.org/software/S1025) has overwritten registry keys for persistence.(Citation: BlackBerry Amadey 2020)","relationship_id":"relationship--c2c31b26-7e42-43b6-964b-c959cabc53a4","references":[{"source_name":"BlackBerry Amadey 2020","description":"Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.","url":"https://blogs.blackberry.com/en/2020/01/threat-spotlight-amadey-bot"}]},{"id":"S1033","name":"DCSrv","url":"https://attack.mitre.org/software/S1033","kind":"malware","description":"[DCSrv](https://attack.mitre.org/software/S1033) has created Registry keys for persistence.(Citation: Checkpoint MosesStaff Nov 2021)","relationship_id":"relationship--150f7dbe-3e64-4ee4-a621-6d416e53af63","references":[{"source_name":"Checkpoint MosesStaff Nov 2021","description":"Checkpoint Research. (2021, November 15). Uncovering MosesStaff techniques: Ideology over Money. Retrieved August 11, 2022.","url":"https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/"}]},{"id":"S1047","name":"Mori","url":"https://attack.mitre.org/software/S1047","kind":"malware","description":"[Mori](https://attack.mitre.org/software/S1047) can write data to `HKLM\\Software\\NFC\\IPA` and `HKLM\\Software\\NFC\\` and delete Registry values.(Citation: DHS CISA AA22-055A MuddyWater February 2022)(Citation: CYBERCOM Iranian Intel Cyber January 2022)","relationship_id":"relationship--b2d24622-d6ee-4a9f-84cc-ecb6efab9625","references":[{"source_name":"CYBERCOM Iranian Intel Cyber January 2022","description":"Cyber National Mission Force. (2022, January 12). Iranian intel cyber suite of malware uses open source tools. Retrieved September 30, 2022.","url":"https://www.cybercom.mil/Media/News/Article/2897570/iranian-intel-cyber-suite-of-malware-uses-open-source-tools/"},{"source_name":"DHS CISA AA22-055A MuddyWater February 2022","description":"FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.","url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"}]},{"id":"S1050","name":"PcShare","url":"https://attack.mitre.org/software/S1050","kind":"tool","description":"[PcShare](https://attack.mitre.org/software/S1050) can delete its persistence mechanisms from the registry.(Citation: Bitdefender FunnyDream Campaign November 2020)","relationship_id":"relationship--d45fe5a0-f9e5-4f05-b40b-8693c8eab0f7","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","description":"Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}]},{"id":"S1058","name":"Prestige","url":"https://attack.mitre.org/software/S1058","kind":"malware","description":"[Prestige](https://attack.mitre.org/software/S1058) has the ability to register new registry keys for a new extension handler via `HKCR\\.enc` and `HKCR\\enc\\shell\\open\\command`.(Citation: Microsoft Prestige ransomware October 2022)","relationship_id":"relationship--86245eed-44d6-4a2a-ad83-1dd6a700a7be","references":[{"source_name":"Microsoft Prestige ransomware October 2022","description":"MSTIC. (2022, October 14). New “Prestige” ransomware impacts organizations in Ukraine and Poland. Retrieved January 19, 2023.","url":"https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"}]},{"id":"S1059","name":"metaMain","url":"https://attack.mitre.org/software/S1059","kind":"malware","description":"[metaMain](https://attack.mitre.org/software/S1059) can write the process ID of a target process into the `HKEY_LOCAL_MACHINE\\SOFTWARE\\DDE\\tpid` Registry value as part of its reflective loading activity.(Citation: SentinelLabs Metador Technical Appendix Sept 2022)","relationship_id":"relationship--51b34c1f-4e2f-4bb7-98a1-fa90ed873eba","references":[{"source_name":"SentinelLabs Metador Technical Appendix Sept 2022","description":"SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.","url":"https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm"}]},{"id":"S1060","name":"Mafalda","url":"https://attack.mitre.org/software/S1060","kind":"malware","description":"[Mafalda](https://attack.mitre.org/software/S1060) can manipulate the system registry on a compromised host.(Citation: SentinelLabs Metador Technical Appendix Sept 2022)","relationship_id":"relationship--35317fb7-9426-4f6e-9c78-64bb7a2da67f","references":[{"source_name":"SentinelLabs Metador Technical Appendix Sept 2022","description":"SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.","url":"https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm"}]},{"id":"S1066","name":"DarkTortilla","url":"https://attack.mitre.org/software/S1066","kind":"malware","description":"[DarkTortilla](https://attack.mitre.org/software/S1066) has modified registry keys for persistence.(Citation: Secureworks DarkTortilla Aug 2022)","relationship_id":"relationship--d6bb4c39-f4d1-41aa-8b0a-363f198ed6ab","references":[{"source_name":"Secureworks DarkTortilla Aug 2022","description":"Secureworks Counter Threat Unit Research Team. (2022, August 17). DarkTortilla Malware Analysis. Retrieved November 3, 2022.","url":"https://www.secureworks.com/research/darktortilla-malware-analysis"}]},{"id":"S1068","name":"BlackCat","url":"https://attack.mitre.org/software/S1068","kind":"malware","description":"[BlackCat](https://attack.mitre.org/software/S1068) has the ability to add the following registry key on compromised networks to maintain persistence: `HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services \\LanmanServer\\Paramenters`(Citation: Microsoft BlackCat Jun 2022)","relationship_id":"relationship--552afd93-370d-4f8e-b2c0-e27d9d7e050e","references":[{"source_name":"Microsoft BlackCat Jun 2022","description":"Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.","url":"https://www.microsoft.com/en-us/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/"}]},{"id":"S1070","name":"Black Basta","url":"https://attack.mitre.org/software/S1070","kind":"malware","description":"[Black Basta](https://attack.mitre.org/software/S1070) has modified the Registry to enable itself to run in safe mode, to change the icons and file extensions for encrypted files, and to add the malware path for persistence.(Citation: Minerva Labs Black Basta May 2022)(Citation: Cyble Black Basta May 2022)(Citation: Trend Micro Black Basta May 2022)(Citation: NCC Group Black Basta June 2022)(Citation: Deep Instinct Black Basta August 2022)(Citation: Palo Alto Networks Black Basta August 2022)","relationship_id":"relationship--5abf323d-03be-4996-ab4b-89317883d0ab","references":[{"source_name":"Cyble Black Basta May 2022","description":"Cyble. (2022, May 6). New ransomware variant targeting high-value organizations. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20220506143054/https://blog.cyble.com/2022/05/06/black-basta-ransomware/"},{"source_name":"Palo Alto Networks Black Basta August 2022","description":"Elsad, A. (2022, August 25). Threat Assessment: Black Basta Ransomware. Retrieved March 8, 2023.","url":"https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware"},{"source_name":"Trend Micro Black Basta May 2022","description":"Gonzalez, I., Chavez I., et al. (2022, May 9). Examining the Black Basta Ransomware’s Infection Routine. Retrieved March 7, 2023.","url":"https://www.trendmicro.com/en_us/research/22/e/examining-the-black-basta-ransomwares-infection-routine.html"},{"source_name":"NCC Group Black Basta June 2022","description":"Inman, R. and Gurney, P. (2022, June 6). Shining the Light on Black Basta. Retrieved March 8, 2023.","url":"https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/"},{"source_name":"Deep Instinct Black Basta August 2022","description":"Vilkomir-Preisman, S. (2022, August 18). Beating Black Basta Ransomware. Retrieved March 8, 2023.","url":"https://www.deepinstinct.com/blog/black-basta-ransomware-threat-emergence"},{"source_name":"Minerva Labs Black Basta May 2022","description":"Zargarov, N. (2022, May 2). New Black Basta Ransomware Hijacks Windows Fax Service. Retrieved March 7, 2023.","url":"https://minerva-labs.com/blog/new-black-basta-ransomware-hijacks-windows-fax-service/"}]},{"id":"S1090","name":"NightClub","url":"https://attack.mitre.org/software/S1090","kind":"malware","description":"[NightClub](https://attack.mitre.org/software/S1090) can modify the Registry to set the ServiceDLL for a service created by the malware for persistence.(Citation: MoustachedBouncer ESET August 2023)\n","relationship_id":"relationship--dd0dbfef-065c-47c9-a9e3-ac8d02f7ca42","references":[{"source_name":"MoustachedBouncer ESET August 2023","description":"Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}]},{"id":"S1099","name":"Samurai","url":"https://attack.mitre.org/software/S1099","kind":"malware","description":"The [Samurai](https://attack.mitre.org/software/S1099) loader component can create multiple Registry keys to force the svchost.exe process to load the final backdoor.(Citation: Kaspersky ToddyCat June 2022)","relationship_id":"relationship--983073e5-9115-46c2-ba78-17e1c111916d","references":[{"source_name":"Kaspersky ToddyCat June 2022","description":"Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.","url":"https://securelist.com/toddycat/106799/"}]},{"id":"S1131","name":"NPPSPY","url":"https://attack.mitre.org/software/S1131","kind":"tool","description":"[NPPSPY](https://attack.mitre.org/software/S1131) modifies the Registry to record the malicious listener for output from the Winlogon process.(Citation: Huntress NPPSPY 2022)","relationship_id":"relationship--58bddfb4-2236-444b-8681-2b2e0fe1f7e2","references":[{"source_name":"Huntress NPPSPY 2022","description":"Dray Agha. (2022, August 16). Cleartext Shenanigans: Gifting User Passwords to Adversaries With NPPSPY. Retrieved May 17, 2024.","url":"https://www.huntress.com/blog/cleartext-shenanigans-gifting-user-passwords-to-adversaries-with-nppspy"}]},{"id":"S1132","name":"IPsec Helper","url":"https://attack.mitre.org/software/S1132","kind":"malware","description":"[IPsec Helper](https://attack.mitre.org/software/S1132) can make arbitrary changes to registry keys based on provided input.(Citation: SentinelOne Agrius 2021)","relationship_id":"relationship--70d725a6-f1d8-46e5-b857-b0cbd0249d6b","references":[{"source_name":"SentinelOne Agrius 2021","description":"Amitai Ben & Shushan Ehrlich. (2021, May). From Wiper to Ransomware: The Evolution of Agrius. Retrieved May 21, 2024.","url":"https://assets.sentinelone.com/sentinellabs/evol-agrius"}]},{"id":"S1149","name":"CHIMNEYSWEEP","url":"https://attack.mitre.org/software/S1149","kind":"malware","description":"[CHIMNEYSWEEP](https://attack.mitre.org/software/S1149) can use the Windows Registry Environment key to change the `%windir%` variable to point to `c:\\Windows` to enable payload execution.(Citation: Mandiant ROADSWEEP August 2022)\n","relationship_id":"relationship--ea54979f-3e4c-459c-bfaa-1435e36729e1","references":[{"source_name":"Mandiant ROADSWEEP August 2022","description":"Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"}]},{"id":"S1178","name":"ShrinkLocker","url":"https://attack.mitre.org/software/S1178","kind":"malware","description":"[ShrinkLocker](https://attack.mitre.org/software/S1178) modifies various registry keys associated with system logon and BitLocker functionality to effectively lock-out users following disk encryption.(Citation: Kaspersky ShrinkLocker 2024)(Citation: Splunk ShrinkLocker 2024)","relationship_id":"relationship--52b695ee-33cb-445a-96b1-3fa074318d44","references":[{"source_name":"Kaspersky ShrinkLocker 2024","description":"Cristian Souza, Eduardo Ovalle, Ashley Muñoz, & Christopher Zachor. (2024, May 23). ShrinkLocker: Turning BitLocker into ransomware. Retrieved December 7, 2024.","url":"https://securelist.com/ransomware-abuses-bitlocker/112643/"},{"source_name":"Splunk ShrinkLocker 2024","description":"Splunk Threat Research Team , Teoderick Contreras. (2024, September 5). ShrinkLocker Malware: Abusing BitLocker to Lock Your Data. Retrieved December 7, 2024.","url":"https://www.splunk.com/en_us/blog/security/shrinklocker-malware-abusing-bitlocker-to-lock-your-data.html"}]},{"id":"S1180","name":"BlackByte Ransomware","url":"https://attack.mitre.org/software/S1180","kind":"malware","description":"[BlackByte Ransomware](https://attack.mitre.org/software/S1180) modifies the victim Registry to prevent system recovery.(Citation: Trustwave BlackByte 2021)","relationship_id":"relationship--c5c1bf20-d215-41cb-a5d2-4388a1ca5e59","references":[{"source_name":"Trustwave BlackByte 2021","description":"Rodel Mendrez & Lloyd Macrohon. (2021, October 15). BlackByte Ransomware – Pt. 1 In-depth Analysis. Retrieved December 16, 2024.","url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/blackbyte-ransomware-pt-1-in-depth-analysis/"}]},{"id":"S1181","name":"BlackByte 2.0 Ransomware","url":"https://attack.mitre.org/software/S1181","kind":"malware","description":"[BlackByte 2.0 Ransomware](https://attack.mitre.org/software/S1181) modifies the victim Registry to allow for elevated execution.(Citation: Microsoft BlackByte 2023)","relationship_id":"relationship--40b51ac6-d391-4fcb-ae32-79705d25301a","references":[{"source_name":"Microsoft BlackByte 2023","description":"Microsoft Incident Response. (2023, July 6). The five-day job: A BlackByte ransomware intrusion case study. Retrieved December 16, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"}]},{"id":"S1190","name":"Kapeka","url":"https://attack.mitre.org/software/S1190","kind":"malware","description":"[Kapeka](https://attack.mitre.org/software/S1190) writes persistent configuration information to the victim host registry.(Citation: WithSecure Kapeka 2024)","relationship_id":"relationship--60a8cf92-7bd7-4e4a-9681-91d227b2609a","references":[{"source_name":"WithSecure Kapeka 2024","description":"Mohammad Kazem Hassan Nejad, WithSecure. (2024, April 17). KAPEKA A novel backdoor spotted in Eastern Europe. Retrieved January 6, 2025.","url":"https://labs.withsecure.com/content/dam/labs/docs/WithSecure-Research-Kapeka.pdf"}]},{"id":"S1199","name":"LockBit 2.0","url":"https://attack.mitre.org/software/S1199","kind":"malware","description":"[LockBit 2.0](https://attack.mitre.org/software/S1199) can create Registry keys to bypass UAC and for persistence.(Citation: FBI Lockbit 2.0 FEB 2022)","relationship_id":"relationship--5cb4493b-1830-436a-8c1b-5aab2ef37442","references":[{"source_name":"FBI Lockbit 2.0 FEB 2022","description":"FBI. (2022, February 4). Indicators of Compromise Associated with LockBit 2.0 Ransomware. Retrieved January 24, 2025.","url":"https://www.ic3.gov/CSA/2022/220204.pdf"}]},{"id":"S1201","name":"TRANSLATEXT","url":"https://attack.mitre.org/software/S1201","kind":"malware","description":"[TRANSLATEXT](https://attack.mitre.org/software/S1201) has modified the following registry key to install itself as the value, granting permission to install specified extensions: ` HKCU\\Software\\Policies\\Google\\Chrome\\ExtensionInstallForcelist`.(Citation: Zscaler Kimsuky TRANSLATEXT) ","relationship_id":"relationship--4a2d2699-a2c0-40e4-8e8d-3450155b9923","references":[{"source_name":"Zscaler Kimsuky TRANSLATEXT","description":"Park, S. (2024, June 27). Kimsuky deploys TRANSLATEXT to target South Korean academia. Retrieved October 14, 2024.","url":"https://www.zscaler.com/blogs/security-research/kimsuky-deploys-translatext-target-south-korean-academia#technical-analysis"}]},{"id":"S1202","name":"LockBit 3.0","url":"https://attack.mitre.org/software/S1202","kind":"malware","description":"[LockBit 3.0](https://attack.mitre.org/software/S1202) can change the Registry values for Group Policy refresh time, to disable SmartScreen, and to disable Windows Defender.(Citation: Joint Cybersecurity Advisory LockBit 3.0 MAR 2023)(Citation: INCIBE-CERT LockBit MAR 2024)\n\n","relationship_id":"relationship--1c4a31d0-3567-4081-93f5-14de47eabecf","references":[{"source_name":"Joint Cybersecurity Advisory LockBit 3.0 MAR 2023","description":"FBI et al. (2023, March 16). #StopRansomware: LockBit 3.0. Retrieved February 5, 2025.","url":"https://www.cisa.gov/sites/default/files/2023-03/aa23-075a-stop-ransomware-lockbit.pdf"},{"source_name":"INCIBE-CERT LockBit MAR 2024","description":"INCIBE-CERT. (2024, March 14). LockBit: response and recovery actions. Retrieved February 5, 2025.","url":"https://www.incibe.es/en/incibe-cert/blog/lockbit-response-and-recovery-actions"}]},{"id":"S1226","name":"BOOKWORM","url":"https://attack.mitre.org/software/S1226","kind":"malware","description":"[BOOKWORM](https://attack.mitre.org/software/S1226) has modified Registry key values as part of its created service `DeviceSync`. (Citation: Unit42 Bookworm Nov2015)","relationship_id":"relationship--53d6538d-5b30-4503-94a3-077ddc428a3a","references":[{"source_name":"Unit42 Bookworm Nov2015","description":"Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.","url":"https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"}]},{"id":"S1230","name":"HIUPAN","url":"https://attack.mitre.org/software/S1230","kind":"malware","description":"[HIUPAN](https://attack.mitre.org/software/S1230) has modified registry keys to ensure hidden files and extensions are not visible through the modification of `HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced`.(Citation: 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA)(Citation: Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024)","relationship_id":"relationship--202a6c36-ba18-4615-88ae-a6e0005eda71","references":[{"source_name":"2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA","description":"Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025.","url":"https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"},{"source_name":"Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024","description":"Lenart Bermejo, Sunny Lu, Ted Lee. (2024, September 9). Earth Preta Evolves its Attacks with New Malware and Strategies. Retrieved August 4, 2025.","url":"https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html"}]},{"id":"S1242","name":"Qilin","url":"https://attack.mitre.org/software/S1242","kind":"malware","description":"[Qilin](https://attack.mitre.org/software/S1242) can make Registry modifications to share networked drives between elevated and non-elevated processes and to increase the number of outstanding network requests per client.(Citation: Halcyon Qilin.B OCT 2024)(Citation: Picus Qilin MAR 2025) [Qilin](https://attack.mitre.org/software/S1242) can also modify `HKEY_CURRENT_USER\\Control Panel\\Desktop\\Wallpaper` to enable posting of ransom messages.(Citation: Cisco Talos Qilin Ransomware OCT 2025)\n","relationship_id":"relationship--6bbefe61-008f-4298-8a9b-364c51ba7c20","references":[{"source_name":"Picus Qilin MAR 2025","description":"Hacioglu, S. (2025, March 10). Qilin Ransomware: Exposing the TTPs Behind One of the Most Active Ransomware Campaigns of 2024. Retrieved September 26, 2025.","url":"https://www.picussecurity.com/resource/blog/qilin-ransomware"},{"source_name":"Halcyon Qilin.B OCT 2024","description":"Halcyon RISE Team. (2024, October 24). New Qilin.B Ransomware Variant Boasts Enhanced Encryption and Defense Evasion. Retrieved September 26, 2025.","url":"https://www.halcyon.ai/blog/new-qilin-b-ransomware-variant-boasts-enhanced-encryption-and-defense-evasion"},{"source_name":"Cisco Talos Qilin Ransomware OCT 2025","description":"Takeda, T. et al. (2025, October 26). Uncovering Qilin attack methods exposed through multiple cases. Retrieved March 26, 2026.","url":"https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/"}]},{"id":"S1247","name":"Embargo","url":"https://attack.mitre.org/software/S1247","kind":"malware","description":"[Embargo](https://attack.mitre.org/software/S1247) has modified and deleted Registry keys to add services, and to disable Security Solutions such as Windows Defender.(Citation: ESET Embargo Ransomware October 2024)","relationship_id":"relationship--74e72fff-a4b9-4802-8eab-0555043d7304","references":[{"source_name":"ESET Embargo Ransomware October 2024","description":"Jan Holman, Tomas Zvara. (2024, October 23). Embargo ransomware: Rock’n’Rust. Retrieved October 19, 2025.","url":"https://www.welivesecurity.com/en/eset-research/embargo-ransomware-rocknrust/"}]},{"id":"S9023","name":"HiddenFace","url":"https://attack.mitre.org/software/S9023","kind":"malware","description":"[HiddenFace](https://attack.mitre.org/software/S9023) can store its configuration file in the Registry.(Citation: JPCERT MirrorFace JUL 2024)","relationship_id":"relationship--eb93689a-f815-4d93-ba6d-6104a60d9a9e","references":[{"source_name":"JPCERT MirrorFace JUL 2024","description":"Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"}]},{"id":"S9025","name":"NOOPLDR","url":"https://attack.mitre.org/software/S9025","kind":"malware","description":"[NOOPLDR](https://attack.mitre.org/software/S9025) can store its payload in the Registry using a random hex string in `HKCU\\SOFTWARE\\Microsoft\\COM3`.(Citation: Trend Micro Earth Kasha NOV 2024)","relationship_id":"relationship--b75982a3-8ba7-4a30-8ed8-894a1e2f75da","references":[{"source_name":"Trend Micro Earth Kasha NOV 2024","description":"Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}]},{"id":"S9032","name":"MuddyViper","url":"https://attack.mitre.org/software/S9032","kind":"malware","description":"[MuddyViper](https://attack.mitre.org/software/S9032) has the ability to clear the Registry values in the Windows Startup folder that were previously set for persistence.(Citation: ESET_MuddyWater_Dec2025)     ","relationship_id":"relationship--7ac875db-8d72-416b-93cf-2712d376d84e","references":[{"source_name":"ESET_MuddyWater_Dec2025","description":"ESET Research. (2025, December 2). MuddyWater: Snakes by the riverbank. Retrieved February 17, 2026.","url":"https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"}]},{"id":"S9050","name":"Vidar","url":"https://attack.mitre.org/software/S9050","kind":"malware","description":"[Vidar](https://attack.mitre.org/software/S9050) has set the Registry value associated with User Access Control (UAC) (i.e. `HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA`) to `0`, which disabled UAC.(Citation: Logpoint_StealerMalwareFamilies_2024)\n","relationship_id":"relationship--8e8730bf-a7cd-4c35-9c6a-ae34552fe59c","references":[{"source_name":"Logpoint_StealerMalwareFamilies_2024","description":"Khadgi, N. (n.d.). A Comprehensive Overview on Stealer Malware Families. Retrieved August 25, 2026.","url":"https://web.archive.org/web/20240517205011/https://www.logpoint.com/wp-content/uploads/2024/03/logpoint-etpr-a-comprehensive-overview-on-stealer-malware-families-1.pdf"}]},{"id":"S9051","name":"The Gentlemen Ransomware","url":"https://attack.mitre.org/software/S9051","kind":"malware","description":"[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has modified registry keys to allow more permissive access controls to include LSA anonymous access controls.(Citation: CheckPointResearch_TheGentlemen_April2026) ","relationship_id":"relationship--a8ead19f-6ea1-48e0-99e3-71ceb0360fcb","references":[{"source_name":"CheckPointResearch_TheGentlemen_April2026","description":"Check Point Research. (2026, April 20). DFIR Report – The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy. Retrieved September 18, 2026.","url":"https://research.checkpoint.com/2026/dfir-report-the-gentlemen/"}]}],"actors":[{"id":"G0010","name":"Turla","url":"https://attack.mitre.org/groups/G0010","kind":"intrusion-set","description":"[Turla](https://attack.mitre.org/groups/G0010) has modified Registry values to store payloads.(Citation: ESET Turla PowerShell May 2019)(Citation: Symantec Waterbug Jun 2019)","relationship_id":"relationship--052be04b-5ff3-4757-a5c1-de012997accc","references":[{"source_name":"ESET Turla PowerShell May 2019","description":"Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019.","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"},{"source_name":"Symantec Waterbug Jun 2019","description":"Symantec DeepSight Adversary Intelligence Team. (2019, June 20). Waterbug: Espionage Group Rolls Out Brand-New Toolset in Attacks Against Governments. Retrieved July 8, 2019.","url":"https://www.symantec.com/blogs/threat-intelligence/waterbug-espionage-governments"}]},{"id":"G0027","name":"Threat Group-3390","url":"https://attack.mitre.org/groups/G0027","kind":"intrusion-set","description":"A [Threat Group-3390](https://attack.mitre.org/groups/G0027) tool has created new Registry keys under `HKEY_CURRENT_USER\\Software\\Classes\\` and `HKLM\\SYSTEM\\CurrentControlSet\\services`.(Citation: Nccgroup Emissary Panda May 2018)(Citation: Trend Micro Iron Tiger April 2021)","relationship_id":"relationship--f88fcb22-698b-4901-b894-a597192c2ba3","references":[{"source_name":"Trend Micro Iron Tiger April 2021","description":"Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021.","url":"https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"},{"source_name":"Nccgroup Emissary Panda May 2018","description":"Pantazopoulos, N., Henry T. (2018, May 18). Emissary Panda – A potential new malicious tool. Retrieved June 25, 2018.","url":"https://research.nccgroup.com/2018/05/18/emissary-panda-a-potential-new-malicious-tool/"}]},{"id":"G0030","name":"Lotus Blossom","url":"https://attack.mitre.org/groups/G0030","kind":"intrusion-set","description":"[Lotus Blossom](https://attack.mitre.org/groups/G0030) has installed tools such as [Sagerunex](https://attack.mitre.org/software/S1210) by writing them to the Windows registry.(Citation: Cisco LotusBlossom 2025)","relationship_id":"relationship--5c89cacf-96fc-40e2-a6ed-b4d4f107cec3","references":[{"source_name":"Cisco LotusBlossom 2025","description":"Joey Chen, Cisco Talos. (2025, February 27). Lotus Blossom espionage group targets multiple industries with different versions of Sagerunex and hacking tools. Retrieved March 15, 2025.","url":"https://blog.talosintelligence.com/lotus-blossom-espionage-group/"}]},{"id":"G0035","name":"Dragonfly","url":"https://attack.mitre.org/groups/G0035","kind":"intrusion-set","description":"[Dragonfly](https://attack.mitre.org/groups/G0035) has modified the Registry to perform multiple techniques through the use of [Reg](https://attack.mitre.org/software/S0075).(Citation: US-CERT TA18-074A)","relationship_id":"relationship--99c360a2-7395-46e4-88fc-dbd757bed5bf","references":[{"source_name":"US-CERT TA18-074A","description":"US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"id":"G0040","name":"Patchwork","url":"https://attack.mitre.org/groups/G0040","kind":"intrusion-set","description":"A [Patchwork](https://attack.mitre.org/groups/G0040) payload deletes Resiliency Registry keys created by Microsoft Office applications in an apparent effort to trick users into thinking there were no issues during application runs.(Citation: TrendMicro Patchwork Dec 2017)","relationship_id":"relationship--1770cc28-c49c-4b70-b4d0-6976efaede16","references":[{"source_name":"TrendMicro Patchwork Dec 2017","description":"Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}]},{"id":"G0047","name":"Gamaredon Group","url":"https://attack.mitre.org/groups/G0047","kind":"intrusion-set","description":"[Gamaredon Group](https://attack.mitre.org/groups/G0047) has removed security settings for VBA macro execution by changing registry values <code>HKCU\\Software\\Microsoft\\Office\\&lt;version&gt;\\&lt;product&gt;\\Security\\VBAWarnings</code> and <code>HKCU\\Software\\Microsoft\\Office\\&lt;version&gt;\\&lt;product&gt;\\Security\\AccessVBOM</code>.(Citation: ESET Gamaredon June 2020)(Citation: CERT-EE Gamaredon January 2021)(Citation: ESET Gamaredon Sept2024) [Gamaredon Group](https://attack.mitre.org/groups/G0047) has also modified Registry keys to hide folders and system files and to add the C2 address under `HKEY_CURRENT_USER\\Console\\WindowsUpdate`. (Citation: SymantecCarbonBlack_ShuckwormUSB_Apr2025) ","relationship_id":"relationship--5edb6931-3262-40a9-acce-3016ac4153d4","references":[{"source_name":"ESET Gamaredon June 2020","description":"Boutin, J. (2020, June 11). Gamaredon group grows its game. Retrieved June 16, 2020.","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source_name":"CERT-EE Gamaredon January 2021","description":"CERT-EE. (2021, January 27). Gamaredon Infection: From Dropper to Entry. Retrieved February 17, 2022.","url":"https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf"},{"source_name":"ESET Gamaredon Sept2024","description":"Rusnák, Z. (2024, September 26). Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023. Retrieved October 30, 2024.","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"},{"source_name":"SymantecCarbonBlack_ShuckwormUSB_Apr2025","description":"Threat Hunter Team, Symantec and Carbon Black. (2025, April 10). Shuckworm Targets Foreign Military Mission Based in Ukraine. Retrieved July 23, 2025.","url":"https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"}]},{"id":"G0049","name":"OilRig","url":"https://attack.mitre.org/groups/G0049","kind":"intrusion-set","description":"[OilRig](https://attack.mitre.org/groups/G0049) has used reg.exe to modify system configuration.(Citation: Symantec Crambus OCT 2023)(Citation: Trend Micro Earth Simnavaz October 2024)","relationship_id":"relationship--8cb570d9-34be-40a7-9ef5-5ab34d89d476","references":[{"source_name":"Trend Micro Earth Simnavaz October 2024","description":"Fahmy, M. et al. (2024, October 11). Earth Simnavaz (aka APT34) Levies Advanced Cyberattacks Against Middle East. Retrieved November 27, 2024.","url":"https://www.trendmicro.com/en_us/research/24/j/earth-simnavaz-cyberattacks.html"},{"source_name":"Symantec Crambus OCT 2023","description":"Symantec Threat Hunter Team. (2023, October 19). Crambus: New Campaign Targets Middle Eastern Government. Retrieved November 27, 2024.","url":"https://www.security.com/threat-intelligence/crambus-middle-east-government"}]},{"id":"G0050","name":"APT32","url":"https://attack.mitre.org/groups/G0050","kind":"intrusion-set","description":"[APT32](https://attack.mitre.org/groups/G0050)'s backdoor has modified the Windows Registry to store the backdoor's configuration. (Citation: ESET OceanLotus Mar 2019)\t","relationship_id":"relationship--76d2d007-1adb-4e04-8e79-dbd799ff57ef","references":[{"source_name":"ESET OceanLotus Mar 2019","description":"Dumont, R. (2019, March 20). Fake or Fake: Keeping up with OceanLotus decoys. Retrieved April 1, 2019.","url":"https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"}]},{"id":"G0059","name":"Magic Hound","url":"https://attack.mitre.org/groups/G0059","kind":"intrusion-set","description":"[Magic Hound](https://attack.mitre.org/groups/G0059) has modified Registry settings for security tools.(Citation: DFIR Report APT35 ProxyShell March 2022)","relationship_id":"relationship--cacbb779-a901-470f-9bb2-cc2d98088713","references":[{"source_name":"DFIR Report APT35 ProxyShell March 2022","description":"DFIR Report. (2022, March 21). APT35 Automates Initial Access Using ProxyShell. Retrieved May 25, 2022.","url":"https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"}]},{"id":"G0061","name":"FIN8","url":"https://attack.mitre.org/groups/G0061","kind":"intrusion-set","description":"[FIN8](https://attack.mitre.org/groups/G0061) has deleted Registry keys during post compromise cleanup activities.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)","relationship_id":"relationship--f8ff17c3-2921-40c2-b4a9-19ee7678397a","references":[{"source_name":"FireEye Know Your Enemy FIN8 Aug 2016","description":"Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy:  New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.","url":"https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"}]},{"id":"G0073","name":"APT19","url":"https://attack.mitre.org/groups/G0073","kind":"intrusion-set","description":"[APT19](https://attack.mitre.org/groups/G0073) uses a Port 22 malware variant to modify several Registry keys.(Citation: Unit 42 C0d0so0 Jan 2016)","relationship_id":"relationship--45f35ec0-73a8-42a6-b879-d800d27211c8","references":[{"source_name":"Unit 42 C0d0so0 Jan 2016","description":"Grunzweig, J., Lee, B. (2016, January 22). New Attacks Linked to C0d0so0 Group. Retrieved August 2, 2018.","url":"https://researchcenter.paloaltonetworks.com/2016/01/new-attacks-linked-to-c0d0s0-group/"}]},{"id":"G0078","name":"Gorgon Group","url":"https://attack.mitre.org/groups/G0078","kind":"intrusion-set","description":"[Gorgon Group](https://attack.mitre.org/groups/G0078) malware can deactivate security mechanisms in Microsoft Office by editing several keys and values under <code>HKCU\\Software\\Microsoft\\Office\\</code>.(Citation: Unit 42 Gorgon Group Aug 2018)","relationship_id":"relationship--9f00ebba-7e80-4495-8ba0-081e6a8cc0c8","references":[{"source_name":"Unit 42 Gorgon Group Aug 2018","description":"Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/"}]},{"id":"G0082","name":"APT38","url":"https://attack.mitre.org/groups/G0082","kind":"intrusion-set","description":"[APT38](https://attack.mitre.org/groups/G0082) uses a tool called CLEANTOAD that has the capability to modify Registry keys.(Citation: FireEye APT38 Oct 2018)","relationship_id":"relationship--0ccca05d-955c-40fa-9fd4-c10480abcf3d","references":[{"source_name":"FireEye APT38 Oct 2018","description":"FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.","url":"https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"}]},{"id":"G0091","name":"Silence","url":"https://attack.mitre.org/groups/G0091","kind":"intrusion-set","description":"[Silence](https://attack.mitre.org/groups/G0091) can create, delete, or modify a specified Registry key or value.(Citation: Group IB Silence Sept 2018)","relationship_id":"relationship--396a5415-67aa-4ec6-ae27-6be641d69e15","references":[{"source_name":"Group IB Silence Sept 2018","description":"Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.","url":"https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."}]},{"id":"G0092","name":"TA505","url":"https://attack.mitre.org/groups/G0092","kind":"intrusion-set","description":"[TA505](https://attack.mitre.org/groups/G0092) has used malware to disable Windows Defender through modification of the Registry.(Citation: Korean FSI TA505 2020)","relationship_id":"relationship--3debe0d7-63bb-4e21-bf9b-ed5e23140e57","references":[{"source_name":"Korean FSI TA505 2020","description":"Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.","url":"https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory="}]},{"id":"G0094","name":"Kimsuky","url":"https://attack.mitre.org/groups/G0094","kind":"intrusion-set","description":"[Kimsuky](https://attack.mitre.org/groups/G0094) has modified Registry settings for default file associations to enable all macros and for persistence.(Citation: CISA AA20-301A Kimsuky)(Citation: Crowdstrike GTR2020 Mar 2020)(Citation: Talos Kimsuky Nov 2021)(Citation: KISA Operation Muzabi) [Kimsuky](https://attack.mitre.org/groups/G0094) has also modified the registry entry for `HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` registry key for persistence with the name WindowsSecurityCheck.(Citation: Aryaka Kimsuky July 2025)","relationship_id":"relationship--c1566ee0-3ddb-4482-94dc-eb05e35e7afa","references":[{"source_name":"Talos Kimsuky Nov 2021","description":"An, J and Malhotra, A. (2021, November 10). North Korean attackers use malicious blogs to deliver malware to high-profile South Korean targets. Retrieved December 29, 2021.","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source_name":"CISA AA20-301A Kimsuky","description":"CISA, FBI, CNMF. (2020, October 27). https://us-cert.cisa.gov/ncas/alerts/aa20-301a. Retrieved November 4, 2020.","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-301a"},{"source_name":"Crowdstrike GTR2020 Mar 2020","description":"Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020.","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"},{"source_name":"KISA Operation Muzabi","description":"KISA. (2021). Phishing Target Reconnaissance and Attack Resource Analysis Operation Muzabi. Retrieved March 8, 2024.","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"},{"source_name":"Aryaka Kimsuky July 2025","description":"Varadharajan Krishnasamy, Aditya K Sood. (2025, July 29). From Reconnaissance  to Control: The Operational Blueprint of Kimsuky APT  for Cyber Espionage. Retrieved April 18, 2026.","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"id":"G0096","name":"APT41","url":"https://attack.mitre.org/groups/G0096","kind":"intrusion-set","description":"[APT41](https://attack.mitre.org/groups/G0096) used a malware variant called GOODLUCK to modify the registry in order to steal credentials.(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021)","relationship_id":"relationship--c8475b1b-c98f-4fdc-89dd-c9b04e6fbd9c","references":[{"source_name":"FireEye APT41 Aug 2019","description":"Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"},{"source_name":"Group IB APT 41 June 2021","description":"Rostovcev, N. (2021, June 10). Big airline heist APT41 likely behind a third-party attack on Air India. Retrieved August 26, 2021.","url":"https://www.group-ib.com/blog/colunmtk-apt41/"}]},{"id":"G0102","name":"Wizard Spider","url":"https://attack.mitre.org/groups/G0102","kind":"intrusion-set","description":"[Wizard Spider](https://attack.mitre.org/groups/G0102) has modified the Registry key <code>HKLM\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest</code> by setting the <code>UseLogonCredential</code> registry value to <code>1</code> in order to force credentials to be stored in clear text in memory. [Wizard Spider](https://attack.mitre.org/groups/G0102) has also modified the WDigest registry key to allow plaintext credentials to be cached in memory.(Citation: CrowdStrike Grim Spider May 2019)(Citation: Mandiant FIN12 Oct 2021)","relationship_id":"relationship--75f0ea4c-5b88-4b14-9859-67379f4ba9b0","references":[{"source_name":"CrowdStrike Grim Spider May 2019","description":"John, E. and Carvey, H. (2019, May 30). Unraveling the Spiderweb: Timelining ATT&CK Artifacts Used by GRIM SPIDER. Retrieved May 12, 2020.","url":"https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics/"},{"source_name":"Mandiant FIN12 Oct 2021","description":"Shilko, J., et al. (2021, October 7). FIN12: The Prolific Ransomware Intrusion Threat Actor That Has Aggressively Pursued Healthcare Targets. Retrieved June 15, 2023.","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}]},{"id":"G0108","name":"Blue Mockingbird","url":"https://attack.mitre.org/groups/G0108","kind":"intrusion-set","description":"[Blue Mockingbird](https://attack.mitre.org/groups/G0108) has used Windows Registry modifications to specify a DLL payload.(Citation: RedCanary Mockingbird May 2020)\t","relationship_id":"relationship--8b3f4fd5-9acd-49e5-bae5-6996ae46aa0f","references":[{"source_name":"RedCanary Mockingbird May 2020","description":"Lambert, T. (2020, May 7). Introducing Blue Mockingbird. Retrieved May 26, 2020.","url":"https://redcanary.com/blog/blue-mockingbird-cryptominer/"}]},{"id":"G0119","name":"Indrik Spider","url":"https://attack.mitre.org/groups/G0119","kind":"intrusion-set","description":"[Indrik Spider](https://attack.mitre.org/groups/G0119) has modified registry keys to prepare for ransomware execution and to disable common administrative utilities.(Citation: Mandiant_UNC2165)","relationship_id":"relationship--1cebf654-8955-4be0-b01f-392ffa2bad0a","references":[{"source_name":"Mandiant_UNC2165","description":"Mandiant Intelligence. (2022, June 2). To HADES and Back: UNC2165 Shifts to LOCKBIT to Evade Sanctions. Retrieved July 29, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc2165-shifts-to-evade-sanctions/"}]},{"id":"G0143","name":"Aquatic Panda","url":"https://attack.mitre.org/groups/G0143","kind":"intrusion-set","description":"[Aquatic Panda](https://attack.mitre.org/groups/G0143) modified the victim registry to enable the `RestrictedAdmin` mode feature, allowing for pass the hash behaviors to function via RDP.(Citation: Crowdstrike HuntReport 2022)","relationship_id":"relationship--77f8ae7e-c2a1-4c9e-95fd-e886ab57a218","references":[{"source_name":"Crowdstrike HuntReport 2022","description":"CrowdStrike. (2023). 2022 Falcon OverWatch Threat Hunting Report. Retrieved May 20, 2024.","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf"}]},{"id":"G1003","name":"Ember Bear","url":"https://attack.mitre.org/groups/G1003","kind":"intrusion-set","description":"[Ember Bear](https://attack.mitre.org/groups/G1003) modifies registry values for anti-forensics and defense evasion purposes.(Citation: Cadet Blizzard emerges as novel threat actor)","relationship_id":"relationship--93570192-4fb5-4d8a-98a7-1f4bb7c2b986","references":[{"source_name":"Cadet Blizzard emerges as novel threat actor","description":"Microsoft Threat Intelligence. (2023, June 14). Cadet Blizzard emerges as a novel and distinct Russian threat actor. Retrieved July 10, 2023.","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"}]},{"id":"G1006","name":"Earth Lusca","url":"https://attack.mitre.org/groups/G1006","kind":"intrusion-set","description":"[Earth Lusca](https://attack.mitre.org/groups/G1006) modified the registry using the command <code>reg add “HKEY_CURRENT_USER\\Environment” /v UserInitMprLogonScript /t REG_SZ /d “[file path]”</code> for persistence.(Citation: TrendMicro EarthLusca 2022)","relationship_id":"relationship--83aedf08-e8eb-4c18-80c1-727ddb0f1d07","references":[{"source_name":"TrendMicro EarthLusca 2022","description":"Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"id":"G1014","name":"LuminousMoth","url":"https://attack.mitre.org/groups/G1014","kind":"intrusion-set","description":"[LuminousMoth](https://attack.mitre.org/groups/G1014) has used malware that adds Registry keys for persistence.(Citation: Kaspersky LuminousMoth July 2021)(Citation: Bitdefender LuminousMoth July 2021)","relationship_id":"relationship--b29088a3-47cf-4799-a8e5-428472908d06","references":[{"source_name":"Bitdefender LuminousMoth July 2021","description":"Botezatu, B and etl. (2021, July 21). LuminousMoth - PlugX, File Exfiltration and Persistence Revisited. Retrieved October 20, 2022.","url":"https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-exfiltration-and-persistence-revisited"},{"source_name":"Kaspersky LuminousMoth July 2021","description":"Lechtik, M, and etl. (2021, July 14). LuminousMoth APT: Sweeping attacks for the chosen few. Retrieved October 20, 2022.","url":"https://securelist.com/apt-luminousmoth/103332/"}]},{"id":"G1017","name":"Volt Typhoon","url":"https://attack.mitre.org/groups/G1017","kind":"intrusion-set","description":"\n[Volt Typhoon](https://attack.mitre.org/groups/G1017) has used `netsh` to create a PortProxy Registry modification on a compromised server running the Paessler Router Traffic Grapher (PRTG).(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)","relationship_id":"relationship--97b0f29c-343d-40fc-a37f-85d65ed26ba6","references":[{"source_name":"CISA AA24-038A PRC Critical Infrastructure February 2024","description":"CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"id":"G1031","name":"Saint Bear","url":"https://attack.mitre.org/groups/G1031","kind":"intrusion-set","description":"[Saint Bear](https://attack.mitre.org/groups/G1031) will leverage malicious Windows batch scripts to modify registry values associated with Windows Defender functionality.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )","relationship_id":"relationship--eff4cf6d-b84d-4fd9-9fd5-1b7f5d06fbad","references":[{"source_name":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","description":"Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}]},{"id":"G1043","name":"BlackByte","url":"https://attack.mitre.org/groups/G1043","kind":"intrusion-set","description":"[BlackByte](https://attack.mitre.org/groups/G1043) performed Registry modifications to escalate privileges and disable security tools.(Citation: Picus BlackByte 2022)(Citation: Cisco BlackByte 2024)","relationship_id":"relationship--56b203da-eda9-4866-8a69-f978a1d34821","references":[{"source_name":"Picus BlackByte 2022","description":"Huseyin Can Yuceel. (2022, February 21). TTPs used by BlackByte Ransomware Targeting Critical Infrastructure. Retrieved December 16, 2024.","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"},{"source_name":"Cisco BlackByte 2024","description":"James Nutland, Craig Jackson, Terryn Valikodath, & Brennan Evans. (2024, August 28). BlackByte blends tried-and-true tradecraft with newly disclosed vulnerabilities to support ongoing attacks. Retrieved December 16, 2024.","url":"https://blog.talosintelligence.com/blackbyte-blends-tried-and-true-tradecraft-with-newly-disclosed-vulnerabilities-to-support-ongoing-attacks/"}]},{"id":"G1044","name":"APT42","url":"https://attack.mitre.org/groups/G1044","kind":"intrusion-set","description":"[APT42](https://attack.mitre.org/groups/G1044) has modified Registry keys to maintain persistence.(Citation: Mandiant APT42-charms) ","relationship_id":"relationship--eebf3764-7500-4798-9a78-3119691a3170","references":[{"source_name":"Mandiant APT42-charms","description":"Mandiant. (n.d.). APT42: Crooked Charms, Cons and Compromises. Retrieved October 9, 2024.","url":"https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"}]},{"id":"G1051","name":"Medusa Group","url":"https://attack.mitre.org/groups/G1051","kind":"intrusion-set","description":"[Medusa Group](https://attack.mitre.org/groups/G1051) has modified Registry keys to elevate privileges, maintain persistence and allow remote access.(Citation: CISA Medusa Group Medusa Ransomware March 2025)","relationship_id":"relationship--22af9ec6-fb67-4007-85f8-70a3be7f209f","references":[{"source_name":"CISA Medusa Group Medusa Ransomware March 2025","description":"Cybersecurity and Infrastructure Security Agency. (2025, March 12). AA25-071A #StopRansomware: Medusa Ransomware. Retrieved October 15, 2025.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"}]}],"mitigations":[{"id":"M1024","name":"Restrict Registry Permissions","url":"https://attack.mitre.org/mitigations/M1024","kind":"course-of-action","description":"Ensure proper permissions are set for Registry hives to prevent users from modifying keys for system components that may lead to privilege escalation.","relationship_id":"relationship--81bb4898-aaa2-4dff-9af8-a97e6b69a95a","references":[]}],"candidates":[{"id":"003f466a-6010-4b15-803a-cbb478a314d7","name":"Disable Windows Toast Notifications","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify the registry of the currently logged in user using reg.exe via cmd console to disable the windows toast notification.\nSee how azorult malware abuses this technique- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/\n","inputs":{},"dependencies":[],"source_definition_sha256":"ccb5d264c4bb449cd10b91c76644082c2cc9d62ce55fa1e770a6952415ae8df3"},{"id":"01b20ca8-c7a3-4d86-af59-059f15ed5474","name":"Disable Windows OS Auto Update","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Disable Auto Update Windows OS feature. Redline is using this as part of its defense evasion.\n","inputs":{},"dependencies":[],"source_definition_sha256":"840bdb60c40b59620af2b61c0975fd7101d3cd46deb01b5227b3587ae4421cef"},{"id":"02d8b9f7-1a51-4011-8901-2d55cca667f9","name":"Modify UseTPMKeyPIN Registry entry","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Allow startup key and PIN with TPM for Bitlocker tool\n","inputs":{},"dependencies":[],"source_definition_sha256":"77365a1a55621b2cf6ec8f337a62b0ffca62ad1bd5a9b9fa43063c5a312911cb"},{"id":"09147b61-40f6-4b2a-b6fb-9e73a3437c96","name":"Disabling ShowUI Settings of Windows Error Reporting (WER)","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"A modification registry to disable ShowUI settings of Windows Error Report. This registry setting can influence the behavior of error reporting dialogs or prompt box. \nThis technique was seen in DarkGate malware as part of its installation.\n","inputs":{},"dependencies":[],"source_definition_sha256":"276664211d7d78126f01d6ecb6b616b378a6f5b3d3673d8753e7b9182957ef40"},{"id":"0b79c06f-c788-44a2-8630-d69051f1123d","name":"BlackByte Ransomware Registry Changes - Powershell","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"This task recreates the steps taken by BlackByte ransomware before it worms to other machines via Powershell.  See \"Preparing to Worm\" section: https://redcanary.com/blog/blackbyte-ransomware/\nThe steps are as follows:\n<ol>\n    <li>1. Elevate Local Privilege by disabling UAC Remote Restrictions</li>\n    <li>2. Enable OS to share network connections between different privilege levels</li>\n    <li>3. Enable long path values for file paths, names, and namespaces to ensure encryption of all file names and paths</li>\n</ol>\nThe registry keys and their respective values will be created upon successful execution.\n","inputs":{},"dependencies":[],"source_definition_sha256":"cef666a4dd72c2ce3d532885c44b5a2826d3f563eb64183fc47cf71740b6766b"},{"id":"10b33fb0-c58b-44cd-8599-b6da5ad6384c","name":"Modify UseTPMPIN Registry entry","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Allow startup PIN with TPM for Bitlocker tool\n","inputs":{},"dependencies":[],"source_definition_sha256":"d1014ebb21751feadc57b2d9d641410dba4fa4e6967ebb44e80b7b8c29bae66c"},{"id":"12e03af7-79f9-4f95-af48-d3f12f28a260","name":"Disable Win Defender Notification","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Disable Win Defender Notification. Redline is using this to disable this win defender feature.\n","inputs":{},"dependencies":[],"source_definition_sha256":"7cf3be48e274d4eeee001f33c196360b8f0c8caabff366b0be124d07a8384c88"},{"id":"12f50e15-dbc6-478b-a801-a746e8ba1723","name":"Activate Windows NoClose Group Policy Feature","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify the registry of the currently logged in user using reg.exe via cmd console to Disable and remove the Shut Down command Group Policy. \nTake note that some Group Policy changes might require a restart to take effect.\nSee how Trojan abuses this technique- https://www.sophos.com/de-de/threat-center/threat-analyses/viruses-and-spyware/Troj~Krotten-N/detailed-analysis\n","inputs":{},"dependencies":[],"source_definition_sha256":"552e5f2f332c60ad60e32e8dfbb21fc9cd129ce4e89e31305345d01507bc0972"},{"id":"1324796b-d0f6-455a-b4ae-21ffee6aa6b9","name":"Modify Registry of Current User Profile - cmd","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify the registry of the currently logged in user using reg.exe via cmd console. Upon execution, the message \"The operation completed successfully.\"\nwill be displayed. Additionally, open Registry Editor to view the new entry in HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced.\n","inputs":{},"dependencies":[],"source_definition_sha256":"36cb4182dc8adbce01d972b3833cd1c19055cfb093af44787b7e9ccc064d5327"},{"id":"15f44ea9-4571-4837-be9e-802431a7bfae","name":"Javascript in registry","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Upon execution, a javascript block will be placed in the registry for persistence.\nAdditionally, open Registry Editor to view the modified entry in HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings.\n","inputs":{},"dependencies":[],"source_definition_sha256":"318a4580d7dcfae982072f156dc139de2fd9c06ed07e1a28b3cee595cad840a9"},{"id":"16bdbe52-371c-4ccf-b708-79fba61f1db4","name":"Enable RDP via Registry (fDenyTSConnections)","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify the registry value of fDenyTSConnections to allow incoming RDP connections. \nThis activity has been observed by multiple ransomware groups, including Hive ransomware. \n[Reference](https://www.rapid7.com/blog/post/2023/01/11/increasing-the-sting-of-hive-ransomware/)\n","inputs":{"remove_rdp_access_during_cleanup":{"description":"Set to 1 if you want the cleanup to remove RDP access to machine","type":"integer","default":"0"}},"dependencies":[],"source_definition_sha256":"c1069efe5ce533f89db6f9ea39096feca0dcc29e842c13f9faf9f7e5c6511a8d"},{"id":"1dd59fb3-1cb3-4828-805d-cf80b4c3bbb5","name":"Windows Add Registry Value to Load Service in Safe Mode without Network","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify the registry to allow a driver, service, to persist in Safe Mode.\nsee https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/ and https://blog.didierstevens.com/2007/03/26/playing-with-safe-mode/ for further details.\nAdding a subkey to Minimal with the name of your service and a default value set to Service, makes that your service will be started when you boot into Safe Mode without networking. The same applies for the Network subkey.\n","inputs":{},"dependencies":[],"source_definition_sha256":"984a1cfd31cdf7d57ac58df0240f84e6efc79b312eed1aaf1a471b1cad8c435a"},{"id":"20fc9daa-bd48-4325-9aff-81b967a84b1d","name":"Activate Windows NoPropertiesMyDocuments Group Policy Feature","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify the registry of the currently logged in user using reg.exe via cmd console to hide Properties from \"My Documents icon\" Group Policy. \nTake note that some Group Policy changes might require a restart to take effect.\nSee how ransomware abuses this technique- https://www.virustotal.com/gui/file/2d7855bf6470aa323edf2949b54ce2a04d9e38770f1322c3d0420c2303178d91/details\n","inputs":{},"dependencies":[],"source_definition_sha256":"3dffcbc40292cd796031b09c15947d63cf879bd43103d12c5d9eaae2a2f5fb19"},{"id":"26fc7375-a551-4336-90d7-3f2817564304","name":"Requires the BitLocker PIN for Pre-boot authentication","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Requires the BitLocker PIN for Pre-boot authentication\n","inputs":{},"dependencies":[],"source_definition_sha256":"8d3ddf0b383e85a5c33cd259eee7bfdeeb9aed9c71214b5e3a597dd2f6f9d8c1"},{"id":"282f929a-6bc5-42b8-bd93-960c3ba35afe","name":"Modify Registry of Local Machine - cmd","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify the Local Machine registry RUN key to change Windows Defender executable that should be ran on startup.  This should only be possible when\nCMD is ran as Administrative rights. Upon execution, the message \"The operation completed successfully.\"\nwill be displayed. Additionally, open Registry Editor to view the modified entry in HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.\n","inputs":{"new_executable":{"description":"New executable to run on startup instead of Windows Defender","type":"string","default":"calc.exe"}},"dependencies":[],"source_definition_sha256":"be4c66b1faca2c4aa315b9e3cfab5e07d22da9216d80eb53502b0d5077399c31"},{"id":"3235aafe-b49d-451b-a1f1-d979fa65ddaf","name":"Abusing MyComputer Disk Fragmentation Path for Persistence","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Replacing the registry settings with custom executable will end up with the replacement programs being executed at the time OS will decide to kick off the respective activity\n","inputs":{},"dependencies":[],"source_definition_sha256":"d85860531693702dfd5535a3474c606d6e05add51628c716f039487a9c63bd7d"},{"id":"335a6b15-b8d2-4a3f-a973-ad69aa2620d7","name":"Windows Auto Update Option to Notify before download","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Windows Auto Update Option to Notify before download. Redline is using this as part of its defense evasion.\n","inputs":{},"dependencies":[],"source_definition_sha256":"e8f1573d1a38e97fb9ac9165360b8aed38ea48ee1e92f309cff8cd52e0f9ebba"},{"id":"3448824b-3c35-4a9e-a8f5-f887f68bea21","name":"Terminal Server Client Connection History Cleared","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"The built-in Windows Remote Desktop Connection (RDP) client (mstsc.exe) saves the remote computer name (or IP address) and the username that is used to login after each successful connection to the remote computer\n","inputs":{},"dependencies":[{"description":"Must have the \"MR9\" Remote Desktop Connection history Key \n"}],"source_definition_sha256":"445ac7c374f346c467ed0865b24724229885f843d246c6ebdcea44c0bc67711b"},{"id":"35727d9e-7a7f-4d0c-a259-dc3906d6e8b9","name":"Mimic Ransomware - Allow Multiple RDP Sessions per User","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"This test emulates Mimic ransomware's ability to enable multiple RDP sessions per user by modifying the fSingleSessionPerUser value within the Terminal Server registry key. \nSee [Mimic Ransomware Overview] (https://www.trendmicro.com/en_us/research/23/a/new-mimic-ransomware-abuses-everything-apis-for-its-encryption-p.html)\n","inputs":{},"dependencies":[],"source_definition_sha256":"0fd473f0174d36f6cb7b2a796d01964e1adc2727d8fc84424e0ca719e74dbc0c"},{"id":"37950714-e923-4f92-8c7c-51e4b6fffbf6","name":"Allow Simultaneous Download Registry","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"A registry modification to allow Simultaneous download in the system.\n","inputs":{},"dependencies":[],"source_definition_sha256":"f04c8f59b560ae399162283a66c59c500e1fc5b0e454a4c8a1b08f9bfb03aeb5"},{"id":"396f997b-c5f8-4a96-bb2c-3c8795cf459d","name":"Disable Windows Auto Reboot for current logon user","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Disable Windows Auto Reboot for current logon user. Redline is using this as part of its defense evasion.\n","inputs":{},"dependencies":[],"source_definition_sha256":"78336602497520ab468d9e6aa8ac7f8b7b173942cfcad8cff91b1c3f2cf993ef"},{"id":"39f1f378-ba8a-42b3-96dc-2a6540cfc1e3","name":"Mimic Ransomware - Enable Multiple User Sessions","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"This test emulates Mimic ransomware's ability to enable multiple user sessions by modifying the AllowMultipleTSSessions value within the Winlogon registry key. \nSee [Mimic Ransomware Overview] (https://www.trendmicro.com/en_us/research/23/a/new-mimic-ransomware-abuses-everything-apis-for-its-encryption-p.html)\n","inputs":{},"dependencies":[],"source_definition_sha256":"b366b97eb5de7ff508ee0aa9cad42d164de4f76c42d076fa1d7913ae25a7819d"},{"id":"3ac0b30f-532f-43c6-8f01-fb657aaed7e4","name":"Modify UsePIN Registry entry","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Allow startup PIN with TPM for Bitlocker tool\n","inputs":{},"dependencies":[],"source_definition_sha256":"962bda22edf4ad46c97b088adf7b3cc2ced253e4ece91997782e3bc0c0bd9976"},{"id":"3b625eaa-c10d-4635-af96-3eae7d2a2f3c","name":"Tamper Win Defender Protection","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Tamper Win Defender Protection. RedLine Stealer is executing another component file to modify this win defender feature in registry. \nTake note that this modification might not be enough to disable this feature but can be a good indicator of malicious process that \ntries to tamper this Win Defender feature settings.\n","inputs":{},"dependencies":[],"source_definition_sha256":"6259fdb7f54763b9113fb88be1a7d7781aac878aad2bac0795ad187f3c1d174c"},{"id":"3dacb0d2-46ee-4c27-ac1b-f9886bf91a56","name":"Disable Windows Lock Workstation Feature","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify the registry of the currently logged in user using reg.exe via cmd console to disable the windows Lock workstation feature.\nSee how ransomware abuses this technique- https://www.bleepingcomputer.com/news/security/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer/\n","inputs":{},"dependencies":[],"source_definition_sha256":"653a266321cb29f130163d560490a14827dfd6f3e9bc323ad8f7fddf8f2b9391"},{"id":"3e757ce7-eca0-411a-9583-1c33b8508d52","name":"Windows HideSCANetwork Group Policy Feature","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify the registry of the currently logged in user using reg.exe via cmd console to remove the networking icon Group Policy. \nTake note that some Group Policy changes might require a restart to take effect.\nSee how ransomware abuses this technique- https://www.virustotal.com/gui/file/2d7855bf6470aa323edf2949b54ce2a04d9e38770f1322c3d0420c2303178d91/details\n","inputs":{},"dependencies":[],"source_definition_sha256":"31d78ea5b4988ae4fc7a788efdd94ecc03e3030022d1f6b29e939883dfc53a0d"},{"id":"4469192c-2d2d-4a3a-9758-1f31d937a92b","name":"Abusing Windows TelemetryController Registry Key for Persistence","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"The Windows Compatibility Telemetry system makes use of the CompatTelRunner.exe binary to run a variety of telemetry tasks. It relies on the registry for instructions on which commands to run. \nIt will run any arbitrary command without restriction of location or type. Blog :https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence\n","inputs":{"new_key":{"description":"New Registry Key Added","type":"string","default":"NewKey"},"new_executable":{"description":"Custom Executable to run","type":"string","default":"C:\\Windows\\System32\\notepad.exe"}},"dependencies":[],"source_definition_sha256":"69529ad4284334378d4f8cdcdb897ab77bfd0ee60e5e4b920411cd6ceea5cc89"},{"id":"45914594-8df6-4ea9-b3cc-7eb9321a807e","name":"Disable Windows Security Center Notifications","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify the registry of the currently logged in user using reg.exe via cmd console to disable the windows security center notification.\nSee how azorult malware abuses this technique- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/\n","inputs":{},"dependencies":[],"source_definition_sha256":"7d0fd4910411d1c3f9ba6f7f7f6da5ac9e28e7d96ad058d469e18f4f8cdb6bb8"},{"id":"4b81bcfa-fb0a-45e9-90c2-e3efe5160140","name":"Disable Remote Desktop Security Settings Through Registry","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"A modification registry to disable RDP security settings. This technique was seen in DarkGate malware as part of its installation\n","inputs":{},"dependencies":[],"source_definition_sha256":"a6cdfc660e5152e768f6e27e478da9de869c33d972a6b6e3bfeac60461ec902d"},{"id":"4c4bf587-fe7f-448f-ba8d-1ecec9db88be","name":"Enforce Smart Card Authentication Through Registry","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Enforce Smart Card Authentication Through Registry\n","inputs":{},"dependencies":[],"source_definition_sha256":"3fc4931755eb0a78607369240e10dd28526059ca3f09818df97cc612a5dd9fd9"},{"id":"4d72d4b1-fa7b-4374-b423-0fe326da49d2","name":"Activate Windows NoTrayContextMenu Group Policy Feature","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify the registry of the currently logged in user using reg.exe via cmd console to Disable context menu for taskbar Group Policy. \nTake note that some Group Policy changes might require a restart to take effect.\nSee how ransomware abuses this technique- https://www.virustotal.com/gui/file/2d7855bf6470aa323edf2949b54ce2a04d9e38770f1322c3d0420c2303178d91/details\n","inputs":{},"dependencies":[],"source_definition_sha256":"e37d62727695630094331aa6210b100d9bb13224687d8760080d27e20f094a93"},{"id":"4f4e2f9f-6209-4fcf-9b15-3b7455706f5b","name":"BlackByte Ransomware Registry Changes - CMD","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"This task recreates the steps taken by BlackByte ransomware before it worms to other machines.  See \"Preparing to Worm\" section: https://redcanary.com/blog/blackbyte-ransomware/\nThe steps are as follows:\n<ol>\n    <li>1. Elevate Local Privilege by disabling UAC Remote Restrictions</li>\n    <li>2. Enable OS to share network connections between different privilege levels</li>\n    <li>3. Enable long path values for file paths, names, and namespaces to ensure encryption of all file names and paths</li>\n</ol>\nThe registry keys and their respective values will be created upon successful execution.\n","inputs":{},"dependencies":[],"source_definition_sha256":"97f356a75da384ea12b5bbc1819f97ccf9188f1949f25eea72fc0a8f14ea3479"},{"id":"573d15da-c34e-4c59-a7d2-18f20d92dfa3","name":"Adding custom paths for application execution","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"As per Microsoft,the entries found under App Paths are used primarily to map an application’s executable file name to that file’s fully qualified path and to pre-pend information to the PATH environment variable on a per-application, per-process basis. \nThe path can be modified to load a custom application of choice. \nPost the registry changes of this test, when someone tries to manually run msedge.exe via StartMenu/Run window , notepad will be launched.\n","inputs":{"app_name":{"description":"path of application to be modified","type":"string","default":"msedge.exe"},"new_path":{"description":"New App Path Added","type":"string","default":"C:\\Windows\\System32\\notepad.exe"}},"dependencies":[],"source_definition_sha256":"bef76c06e144e73c926385f9566ed8f2182cb8a2e7f5270a7123b091c1ed286f"},{"id":"599f3b5c-0323-44ed-bb63-4551623bf675","name":"Abusing MyComputer Disk Backup Path for Persistence","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Replacing the registry settings with custom executable will end up with the replacement programs being executed at the time OS will decide to kick off the respective activity\n","inputs":{},"dependencies":[],"source_definition_sha256":"9b6cec7177ef81ad64466d70392f929362bf89c1f2d7df5316d7a7ad1817f06d"},{"id":"5e27bdb4-7fd9-455d-a2b5-4b4b22c9dea4","name":"Activate Windows NoFileMenu Group Policy Feature","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify the registry of the currently logged in user using reg.exe via cmd console to Remove File menu from Windows Explorer Group Policy. \nTake note that some Group Policy changes might require a restart to take effect.\nSee how Trojan abuses this technique- https://www.sophos.com/de-de/threat-center/threat-analyses/viruses-and-spyware/Troj~Krotten-N/detailed-analysis\n","inputs":{},"dependencies":[],"source_definition_sha256":"4596f737523a9c6f5eb6d287db1c00044c5f734dfdeed4976552f70c8c3fb5a7"},{"id":"5f8e36de-37ca-455e-b054-a2584f043c06","name":"Disable Windows Remote Desktop Protocol","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify the registry of the machine to disable remote desktop protocol.\n","inputs":{},"dependencies":[],"source_definition_sha256":"26457337303f6f4a42a849b21921eb2d32dc0e73b92c8266ed34756a6b533b04"},{"id":"6174be7f-5153-4afd-92c5-e0c3b7cdb5ae","name":"Event Viewer Registry Modification - Redirection URL","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify event viewer registry values to alter the behavior of the online help redirection. Upon opening an event in event viewer and attempting to view the help page for the event, it will open the URL or execute the program defined in the redirection URL registry entry.","inputs":{"redirection_url":{"description":"URL to open or file URI to execute upon opening the event help","type":"url","default":"file://C:\\windows\\system32\\notepad.exe"}},"dependencies":[],"source_definition_sha256":"27911e76b824cdcecadd232c6e93267a80cb2b37972344d808407750a665fa7b"},{"id":"61d35188-f113-4334-8245-8c6556d43909","name":"Disable Remote Desktop Anti-Alias Setting Through Registry","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"A modification registry to disable RDP anti-alias settings. This technique was seen in DarkGate malware as part of its installation\n","inputs":{},"dependencies":[],"source_definition_sha256":"01385b60d50d3e4f5941e60cbc5da18416c232c40651266f47aeb275a228010e"},{"id":"65704cd4-6e36-4b90-b6c1-dc29a82c8e56","name":"NetWire RAT Registry Key Creation","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"NetWire continues to create its home key (HKCU\\SOFTWARE\\NetWire) as well as adding it into the auto-run group in the victim’s registry.\nSee how NetWire malware - https://app.any.run/tasks/41ecdbde-4997-4301-a350-0270448b4c8f/\n","inputs":{},"dependencies":[],"source_definition_sha256":"ac98292927cb28ff858117da40f37f586fcbbb124d48a68ba7f333998aade4b4"},{"id":"68254a85-aa42-4312-a695-38b7276307f8","name":"Use Powershell to Modify registry to store logon credentials","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Sets registry key using Powershell that will tell windows to store plaintext passwords (making the system vulnerable to clear text / cleartext password dumping).\nOpen Registry Editor to view the modified entry in HKLM\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\WDigest.\n","inputs":{},"dependencies":[],"source_definition_sha256":"d70dda2c6f027ff7537c684d3d31d8e1c36fc747140fdf3cb0f0afaca5b0dd5b"},{"id":"6e0d1131-2d7e-4905-8ca5-d6172f05d03d","name":"Disable Windows Shutdown Button","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify the registry of the currently logged in user using reg.exe via cmd console to disable the windows shutdown button.\nSee how ransomware abuses this technique- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.msil.screenlocker.a/\n","inputs":{},"dependencies":[],"source_definition_sha256":"7f0ee45b57649620f64b98022d4e3cf27bf8b144f691029a2f51350c3a362a36"},{"id":"71db768a-5a9c-4047-b5e7-59e01f188e84","name":"DisallowRun Execution Of Certain Applications","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify the registry of the currently logged in user using reg.exe via cmd console to prevent user running specific computer programs that could aid them in manually removing malware or detecting it \nusing security product.\n","inputs":{},"dependencies":[],"source_definition_sha256":"f50ec5bfff4e4d4966c38dbac3034892346e27ec048cfec8df7a6051cff06f7d"},{"id":"795d3248-0394-4d4d-8e86-4e8df2a2693f","name":"Windows Modify Show Compress Color And Info Tip Registry","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify the registry of the currently logged in user using reg.exe via cmd console to show compress color and show tips feature. \nSee how hermeticwiper uses this technique - https://www.splunk.com/en_us/blog/security/detecting-hermeticwiper.html\n","inputs":{},"dependencies":[],"source_definition_sha256":"324d31ec372493a53318dfd9ac3fea0b3b8a62d5022b0201eda7a221d90f2662"},{"id":"7979dd41-2045-48b2-a54e-b1bc2415c9da","name":"Disable Windows Prefetch Through Registry","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify the registry of the machine to disable prefetch. Disabling prefetch will remove one artifact for evidence of application execution. Restart is required post modification\n","inputs":{},"dependencies":[],"source_definition_sha256":"fe351dad05a4f261562cfcd54d2241d67ced977008e3ba2a6a5058626e8052ad"},{"id":"7c8c7bd8-0a5c-4514-a6a3-0814c5a98cf0","name":"Modify UseTPM Registry entry","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Use Trusted Platform Module (TPM) for Bitlocker tool\n","inputs":{},"dependencies":[],"source_definition_sha256":"373459c47c3a2670ce9ae09fff24f2dcc4a5c79c54b77aa4636188d238ee33d0"},{"id":"7e7b62e9-5f83-477d-8935-48600f38a3c6","name":"RDP Authentication Level Override","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"A modification registry to override RDP Authentication Level. This technique was seen in DarkGate malware as part of its installation.\n","inputs":{},"dependencies":[],"source_definition_sha256":"3ab5e4d1ab0bf27c6f5ebbded15cb64f08fadfd58b11e93054fa7ec513fcbab9"},{"id":"7f037590-b4c6-4f13-b3cc-e424c5ab8ade","name":"Windows HideSCAVolume Group Policy Feature","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify the registry of the currently logged in user using reg.exe via cmd console to remove the volume icon Group Policy. \nTake note that some Group Policy changes might require a restart to take effect..\nSee how ransomware abuses this technique- https://www.virustotal.com/gui/file/2d7855bf6470aa323edf2949b54ce2a04d9e38770f1322c3d0420c2303178d91/details\n","inputs":{},"dependencies":[],"source_definition_sha256":"96c02b15f83c749de7ff6c492edad62530b35d1be997006be026abe1e57250ee"},{"id":"8023db1e-ad06-4966-934b-b6a0ae52689e","name":"Hide Windows Clock Group Policy Feature","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify the registry of the currently logged in user using reg.exe via cmd console to Hide Clock Group Policy. \nTake note that some Group Policy changes might require a restart to take effect.\nSee how ransomware abuses this technique- https://www.virustotal.com/gui/file/2d7855bf6470aa323edf2949b54ce2a04d9e38770f1322c3d0420c2303178d91/details\n","inputs":{},"dependencies":[],"source_definition_sha256":"4086d3647065a80976906bb71624ad524fe0c623616c9e9ff472525945fca658"},{"id":"81483501-b8a5-4225-8b32-52128e2f69db","name":"Event Viewer Registry Modification - Redirection Program","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify event viewer registry values to alter the behavior of the online help redirection. Upon opening an event in event viewer and attempting to view the help page for the event, it will execute the program defined in the redirection program registry entry.","inputs":{"redirection_program":{"description":"Path of the program to execute upon opening the event help","type":"path","default":"C:\\windows\\system32\\notepad.exe"}},"dependencies":[],"source_definition_sha256":"45d432785e9a49e0cbc547e76bbf93e467ffea3c5b9675274b587541b9a75b28"},{"id":"8318ad20-0488-4a64-98f4-72525a012f6b","name":"Snake Malware Registry Blob","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"The following Atomic Test creates a registry blob in HKLM:\\SOFTWARE\\Classes\\.wav\\OpenWithProgIds, which is related to Snake Malware. Per the report, upon execution, Snake's WerFault.exe will attempt to decrypt an encrypted blob within the Windows\nregistry that is typically found at HKLM:\\SOFTWARE\\Classes\\.wav\\OpenWithProgIds. The encrypted data includes the AES key, IV, and path that is used to find and decrypt the file containing Snake's kernel driver and kernel driver loader.\n","inputs":{},"dependencies":[],"source_definition_sha256":"9c2374b291dd3d092d87ab513dab54d9c37061c3edf7c85e7d5da9e79f9f6af1"},{"id":"86677d0e-0b5e-4a2b-b302-454175f9aa9e","name":"Allow RDP Remote Assistance Feature","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify the registry of the currently logged in user using reg.exe via cmd console to allow rdp remote assistance feature. This feature allow specific\nuser to rdp connect on the targeted machine.\nSee how azorult malware abuses this technique- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/\n","inputs":{},"dependencies":[],"source_definition_sha256":"c4df918c5031fa13556e99293b301ae3492105b84210bce7e74a2768bcf56106"},{"id":"8d85a5d8-702f-436f-bc78-fcd9119496fc","name":"Windows HideSCAPower Group Policy Feature","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify the registry of the currently logged in user using reg.exe via cmd console to remove the battery icon Group Policy. \nTake note that some Group Policy changes might require a restart to take effect.\nSee how ransomware abuses this technique- https://www.virustotal.com/gui/file/2d7855bf6470aa323edf2949b54ce2a04d9e38770f1322c3d0420c2303178d91/details\n","inputs":{},"dependencies":[],"source_definition_sha256":"ed961a79debab085c72b358756df9fe13c632dbebf476c73d20a8034f5f1c337"},{"id":"93386d41-525c-4a1b-8235-134a628dee17","name":"Activate Windows NoDesktop Group Policy Feature","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify the registry of the currently logged in user using reg.exe via cmd console to hide all icons on Desktop Group Policy. \nTake note that some Group Policy changes might require a restart to take effect.\nSee how Trojan abuses this technique- https://www.sophos.com/de-de/threat-center/threat-analyses/viruses-and-spyware/Troj~Krotten-N/detailed-analysis\n","inputs":{},"dependencies":[],"source_definition_sha256":"5a2146d6ceee816703954c4f9f07a3d62fdd19fcd90f19dcb3ab763197ab534a"},{"id":"95b25212-91a7-42ff-9613-124aca6845a8","name":"Windows Powershell Logging Disabled","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify the registry of the currently logged in user using reg.exe via cmd console to disable Powershell Module Logging, Script Block Logging, Transcription and Script Execution\nsee https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.PowerShell::EnableModuleLogging\n","inputs":{},"dependencies":[],"source_definition_sha256":"a31ff09339ab4300f598b02323c21485cbab35386f5e67f2233940115c5e8e1e"},{"id":"a450e469-ba54-4de1-9deb-9023a6111690","name":"Activate Windows NoControlPanel Group Policy Feature","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify the registry of the currently logged in user using reg.exe via cmd console to Disable Control Panel Group Policy. \nTake note that some Group Policy changes might require a restart to take effect.\nSee how Trojan abuses this technique- https://www.sophos.com/de-de/threat-center/threat-analyses/viruses-and-spyware/Troj~Krotten-N/detailed-analysis\n","inputs":{},"dependencies":[],"source_definition_sha256":"b39a6fd193651407d04d186bbb26013c93857123fc5f20922040a21ed76eaa12"},{"id":"a4637291-40b1-4a96-8c82-b28f1d73e54e","name":"Windows HideSCAHealth Group Policy Feature","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify the registry of the currently logged in user using reg.exe via cmd console to remove security and maintenance icon Group Policy. \nTake note that some Group Policy changes might require a restart to take effect.\nSee how ransomware abuses this technique- https://www.virustotal.com/gui/file/2d7855bf6470aa323edf2949b54ce2a04d9e38770f1322c3d0420c2303178d91/details\n","inputs":{},"dependencies":[],"source_definition_sha256":"e057b3a046a1134e236b5ccd84e1f5ce496de4967085192397c6b6c1563ed8db"},{"id":"ac34b0f7-0f85-4ac0-b93e-3ced2bc69bb8","name":"Disable Windows Registry Tool","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify the registry of the currently logged in user using reg.exe via cmd console to disable the windows registry tool to prevent user modifying registry entry.\nSee example how Agent Tesla malware abuses this technique: https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry\n","inputs":{},"dependencies":[],"source_definition_sha256":"5fc888171eda99edd6df6cbd58b7a2e1f0188606b9616a7263edcd0f2ff2b218"},{"id":"ac494fe5-81a4-4897-af42-e774cf005ecb","name":"Setting Shadow key in Registry for RDP Shadowing","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Microsoft Remote Desktop Protocol (RDP) supports a “shadowing” feature and RDP is available in all Windows Server Operating Systems and the business editions of end-user Windows versions.\nIn order to use the RDP shadowing feature, the Remote Desktop Services (TermService) service needs to be running (which it does by default), a rule needs to be enabled in the Windows Firewall and in case of stealth reasons, a setting needs to be configured to not prompt the user for permission when they are being shadowed.\nIn order to configure RDP shadowing session in a quiet mode.  The registry of a remote system can be updated using several protocols, depending on the accessible ports and configuration of the services listening on those ports. Our aim is to set the Shadow value in HKLM\\Software\\Policies\\Microsoft\\Windows NT\\Terminal Services on the remote machine to 2, which allows us to both view and control the session without the user being informed.\n[Reference](https://blog.bitsadmin.com/spying-on-users-using-rdp-shadowing)","inputs":{"server_name":{"description":"The remote server that we need to shadow and have to do the registry modification.","type":"string","default":"localhost"}},"dependencies":[],"source_definition_sha256":"3cd766ec80c180c72380fdbb259a0f118fdcdb12ec997585016fa6b0d899b77e"},{"id":"af254e70-dd0e-4de6-9afe-a994d9ea8b62","name":"Disable Windows Task Manager application","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify the registry of the currently logged in user using reg.exe via cmd console to disable the windows task manager application.\nSee example how Agent Tesla malware abuses this technique: https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry\n","inputs":{},"dependencies":[],"source_definition_sha256":"43523bfad5495dc440620333d800d835f9921dba9f0c95de402cfa12fcde3a08"},{"id":"b1a4d687-ba52-4057-81ab-757c3dc0d3b5","name":"Modify Internet Zone Protocol Defaults in Current User Registry - PowerShell","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"This test simulates an adversary modifying the Internet Zone Protocol Defaults in the registry of the currently logged-in user using PowerShell. Such modifications can be indicative of an adversary attempting to weaken browser security settings. \nTo verify the effects of the test:\n1. Open the Registry Editor (regedit.exe).\n2. Navigate to \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProtocolDefaults\".\n3. Check for the presence of the \"http\" and \"https\" DWORD values set to `0`.\nOr run:\n```powershell\nGet-ItemProperty -Path 'HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProtocolDefaults' | Select-Object http,https\n```\n","inputs":{},"dependencies":[],"source_definition_sha256":"48da1a992887934561b277260bcd0a590ac51b3c702757270c5b0a00f8e7699c"},{"id":"b5169fd5-85c8-4b2c-a9b6-64cc0b9febef","name":"Modify UsePartialEncryptionKey Registry entry","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Allow startup key with TPM for Bitlocker tool\n","inputs":{},"dependencies":[],"source_definition_sha256":"56578d8c280c2f22b5cb801d1dcb33f984dcbba2b94f3a94bfa1e99a1ed3f02c"},{"id":"b6a03947-452c-4137-afaa-112b3c924fd6","name":"Turla Mosquito - Store Backdoor Path in OneDriveUpdate Registry Key","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Emulates the registry-storing behavior of Turla's Mosquito backdoor. Mosquito records its components in the registry key HKCU\\Software\\Microsoft\\Windows\\OneDriveUpdate\nso its loader can reassemble the chain at runtime. It writes:\n\n  1. The name of the original (legitimately hijacked) DLL, tagged with the CLSID, into an\n     \"explorer.exe\" value under the OneDriveUpdate key.\n  2. The path to the main backdoor into the default value of the same OneDriveUpdate key.\n\nMosquito disguises its backdoor as an Adobe Acrobat support file (AdobeSysFnt09.pdb). This test\nonly writes the registry values referencing that IOC-matching file path and hijacked DLL name.\n\nReference: https://www.welivesecurity.com/wp-content/uploads/2018/05/ESET_Turla_Mosquito.pdf\n","inputs":{},"dependencies":[{"description":"Back up any pre-existing OneDriveUpdate registry key so its original values can be restored during cleanup.\n"}],"source_definition_sha256":"9981456059e450d654ec6ae6ec254deadbf49124e223f20e0aebb78d057220ae"},{"id":"bacb3e73-8161-43a9-8204-a69fe0e4b482","name":"Modify EnableBDEWithNoTPM Registry entry","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Allow BitLocker without a compatible TPM (requires a password)\n","inputs":{},"dependencies":[],"source_definition_sha256":"13cfefbb5323077c250e0b77ef173bd617390c714183c3b2d53d39e5e63de706"},{"id":"c0413fb5-33e2-40b7-9b6f-60b29f4a7a18","name":"Modify registry to store logon credentials","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Sets registry key that will tell windows to store plaintext passwords (making the system vulnerable to clear text / cleartext password dumping).\nUpon execution, the message \"The operation completed successfully.\" will be displayed.\nAdditionally, open Registry Editor to view the modified entry in HKLM\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\WDigest.\n","inputs":{},"dependencies":[],"source_definition_sha256":"f5956e238b565cfd18ea6cd8120f1b81f8f62f4e35f9d1b5b03ad509ab5bd9fe"},{"id":"c0d6d67f-1f63-42cc-95c0-5fd6b20082ad","name":"Disable Windows Notification Center","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify the registry of the currently logged in user using reg.exe via cmd console to disable the windows notification center.\nSee how remcos rat abuses this technique- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html\n","inputs":{},"dependencies":[],"source_definition_sha256":"04b147f06edc7d281149d1d90d9b0f4e6b348565ad3e4160da49be1e99954562"},{"id":"c173c948-65e5-499c-afbe-433722ed5bd4","name":"Windows Add Registry Value to Load Service in Safe Mode with Network","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify the registry to allow a driver, service, to persist in Safe Mode with networking.\nsee https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/ and https://blog.didierstevens.com/2007/03/26/playing-with-safe-mode/ for further details.\nAdding a subkey to Netowrk with the name of your service and a default value set to Service, makes that your service will be started when you boot into Safe Mode with networking.\n","inputs":{},"dependencies":[],"source_definition_sha256":"406f2daba8ef92297d57a5e34f0e0a1d937c0c8a8fa9b74dbb55296ae46f2441"},{"id":"c26fb85a-fa50-4fab-a64a-c51f5dc538d5","name":"Activities To Disable Secondary Authentication Detected By Modified Registry Value.","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Detect the disable secondary authentication activities that adversary attempt to bypass MFA and to get the unauthorized access to the system or sensitive data.\nSee the related article (https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.SecondaryAuthenticationFactor::MSSecondaryAuthFactor_AllowSecondaryAuthenticationDevice).\n","inputs":{},"dependencies":[],"source_definition_sha256":"05fa81d5dbbc0b91aad9774f97aeb52b83a2a1b113454e2c6474ec2da5682474"},{"id":"c30dada3-7777-4590-b970-dc890b8cf113","name":"Suppress Win Defender Notifications","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify the registry of the currently logged in user using reg.exe via cmd console to suppress the windows defender notification.\nSee how azorult malware abuses this technique- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/\n","inputs":{},"dependencies":[],"source_definition_sha256":"922ea1bb792714335fe2bddf63b091ad470e49dd8a96cee4ab721daaafad2b96"},{"id":"c375558d-7c25-45e9-bd64-7b23a97c1db0","name":"Ursnif Malware Registry Key Creation","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Ursnif downloads additional modules from the C&C server and saves these in the registry folder HKEY_CURRENT_USER\\Software\\AppDataLow\\Software\\Microsoft\\\nMore information - https://blog.trendmicro.com/trendlabs-security-intelligence/phishing-campaign-uses-hijacked-emails-to-deliver-ursnif-by-replying-to-ongoing-threads/\n","inputs":{},"dependencies":[],"source_definition_sha256":"54d2929d3a74808c7f4f121c2b8c8f3d931b390f40ca09b764ad0d19ebceda28"},{"id":"c691cee2-8d17-4395-b22f-00644c7f1c2d","name":"Modify RDP-Tcp Initial Program Registry Entry","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"If the fInheritInitialProgram value is set to 1, the exe indicated in the InitialProgram value is automatically started on RDP connection.\nOnce the test commands are run, notepad will execute automatically on new RDP connection\n","inputs":{},"dependencies":[],"source_definition_sha256":"4b3bd805e53e2dbaaccab34f23d051ba65d8323f7ddbfdff0eb2d759f9a7aea0"},{"id":"c8480c83-a932-446e-a919-06a1fd1e512a","name":"Modify UseTPMKey Registry entry","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Allow startup key with TPM for Bitlocker tool\n","inputs":{},"dependencies":[],"source_definition_sha256":"0037f30ddad114a2d60f0ba34c95c70d239058ef523636866a7e5a429f87e478"},{"id":"c88ef166-50fa-40d5-a80c-e2b87d4180f7","name":"Modify Internet Zone Protocol Defaults in Current User Registry - cmd","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"This test simulates an adversary modifying the Internet Zone Protocol Defaults in the registry of the currently logged-in user using the reg.exe utility via the command prompt. Such modifications can be indicative of an adversary trying to weaken browser security settings. Upon execution, if successful, the message \"The operation completed successfully.\" will be displayed.\nTo verify the effects of the test:\n1. Open the Registry Editor (regedit.exe).\n2. Navigate to \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProtocolDefaults\".\n3. Check for the presence of the \"http\" and \"https\" DWORD values set to `0`.\nOr run:\n```batch\nreg query \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProtocolDefaults\"\n```\n","inputs":{},"dependencies":[],"source_definition_sha256":"0f2a1482a883d40d8f0f304a9c21cb33d4ea9549ce55553559c042567505639a"},{"id":"ca8ba39c-3c5a-459f-8e15-280aec65a910","name":"Scarab Ransomware Defense Evasion Activities","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Scarab Ransomware defense evasion activities that can abuse the registry values to modify the settings of the Credential Security Support Provider to overcome potential RDP connection issues.\n[Scarab Ransomware Article](https://www.welivesecurity.com/en/eset-research/scarabs-colon-izing-vulnerable-servers/)\n","inputs":{},"dependencies":[],"source_definition_sha256":"eb6f87a7f7e3073ca9f30de6f8beea14324652c963c46c832d8fd2118fefd065"},{"id":"cf447677-5a4e-4937-a82c-e47d254afd57","name":"Add domain to Trusted sites Zone","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Attackers may add a domain to the trusted site zone to bypass defenses. Doing this enables attacks such as c2 over office365.\nUpon execution, details of the new registry entries will be displayed.\nAdditionally, open Registry Editor to view the modified entry in HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\.\n\nhttps://www.blackhat.com/docs/us-17/wednesday/us-17-Dods-Infecting-The-Enterprise-Abusing-Office365-Powershell-For-Covert-C2.pdf\n","inputs":{"bad_domain":{"description":"Domain to add to trusted site zone","type":"string","default":"bad-domain.com"}},"dependencies":[],"source_definition_sha256":"afd1d554957ca57424150ff0ff041be709ddee8c4a4ee05d6d091d240047be72"},{"id":"d1de3767-99c2-4c6c-8c5a-4ba4586474c8","name":"Do Not Connect To Win Update","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Do Not Connect To Win Update. Redline is using this as part of its defense evasion.\n","inputs":{},"dependencies":[],"source_definition_sha256":"459987df6e0ac9fd836e60b4c7d7f185ffc94c4111f7c9fd23d684e1f8006cb6"},{"id":"d2561a6d-72bd-408c-b150-13efe1801c2a","name":"Disable Windows CMD application","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify the registry of the currently logged in user using reg.exe via cmd console to disable the windows CMD application.\nSee example how Agent Tesla malware abuses this technique: https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry\n","inputs":{},"dependencies":[],"source_definition_sha256":"8b016d34045ac8a5d3e2fda680c9619e4725b7d374690a36cf87d64555c06168"},{"id":"d29b7faf-7355-4036-9ed3-719bd17951ed","name":"Activate Windows NoSetTaskbar Group Policy Feature","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify the registry of the currently logged in user using reg.exe via cmd console to Disable changes to Taskbar and Start Menu Settings Group Policy. \nTake note that some Group Policy changes might require a restart to take effect.\nSee how ransomware abuses this technique- https://www.virustotal.com/gui/file/2d7855bf6470aa323edf2949b54ce2a04d9e38770f1322c3d0420c2303178d91/details\n","inputs":{},"dependencies":[],"source_definition_sha256":"aa1ed40bf8a2dccbbaae326805bdccad99c97d24383e7306b69c6b93d814d71a"},{"id":"d2c9e41e-cd86-473d-980d-b6403562e3e1","name":"Disable Windows Error Reporting Settings","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify the registry of the currently logged in user using reg.exe via cmd console to disable windows error reporting settings. This Windows feature allow the use to report bug, errors, failure or problems \nencounter in specific application or process.\nSee how azorult malware abuses this technique- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/\n","inputs":{},"dependencies":[],"source_definition_sha256":"71ab191bf15d16773edf79c19cdefe2b1ed630e0b7db58ac06f15c0d70f79e4e"},{"id":"d49ff3cc-8168-4123-b5b3-f057d9abbd55","name":"Activate Windows NoRun Group Policy Feature","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify the registry of the currently logged in user using reg.exe via cmd console to Remove Run menu from Start Menu Group Policy.\nTake note that some Group Policy changes might require a restart to take effect.\nSee how Trojan abuses this technique- https://www.sophos.com/de-de/threat-center/threat-analyses/viruses-and-spyware/Troj~Krotten-N/detailed-analysis\n","inputs":{},"dependencies":[],"source_definition_sha256":"b59277dc8d5658e86fc1427f125c22bd158cde2a59411e206ba3650598f1cb23"},{"id":"d4a6da40-618f-454d-9a9e-26af552aaeb0","name":"Disable Windows Change Password Feature","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify the registry of the currently logged in user using reg.exe via cmd console to disable the windows change password feature.\nSee how ransomware abuses this technique- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_heartbleed.thdobah\n","inputs":{},"dependencies":[],"source_definition_sha256":"e3634ffdab09267237a5734beb0dcce479a49141065d07b3f6382c4dc6de4d7b"},{"id":"d88a3d3b-d016-4939-a745-03638aafd21b","name":"Set-Up Proxy Server","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"A modification registry to setup proxy server. This technique was seen in DarkGate malware as part of its installation.\n","inputs":{},"dependencies":[],"source_definition_sha256":"8c9f5ed851cd236d12995c6d94a8928e1eed38085db367840345f499e5b4c50c"},{"id":"e246578a-c24d-46a7-9237-0213ff86fb0c","name":"Disable Windows LogOff Button","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify the registry of the currently logged in user using reg.exe via cmd console to disable the windows logoff button.\nSee how ransomware abuses this technique- https://www.trendmicro.com/vinfo/be/threat-encyclopedia/search/js_noclose.e/2\n","inputs":{},"dependencies":[],"source_definition_sha256":"cff13a2da7851282438b3559e728f3457f6601ce97da1e415f6be6e423a51a6d"},{"id":"e3ad8e83-3089-49ff-817f-e52f8c948090","name":"Enabling Remote Desktop Protocol via Remote Registry","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Enabling RDP through remote registry.\n","inputs":{},"dependencies":[],"source_definition_sha256":"31f91d1e3f68c5210710f2a09e3e767fbed6627d1e88e0fab16491afbee0259c"},{"id":"e672a340-a933-447c-954c-d68db38a09b1","name":"Modify EnableNonTPM Registry entry","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Allow Bitlocker without TPM for Bitlocker tool\n","inputs":{},"dependencies":[],"source_definition_sha256":"d367a5003cba6ddc55f22bae828ce1944ac924a2c051f9e326601173b5dbeda5"},{"id":"e8c7c404-b669-4cf9-bafd-fdad89a5bbb1","name":"Disable UAC remote restrictions via LocalAccountTokenFilterPolicy","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Sets the LocalAccountTokenFilterPolicy registry value to 1 under\nHKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System. This disables UAC\nremote restrictions (token filtering) so that local administrator accounts receive\na full (non-filtered) high-integrity token when authenticating over the network,\nenabling remote administrative actions such as Pass-the-Hash and remote WMI/SMB\nadmin access.\n","inputs":{},"dependencies":[{"description":"Save current LocalAccountTokenFilterPolicy state for cleanup restore.\n"}],"source_definition_sha256":"4800111fc3cf487aabc11633453caf1459769dfd65a9323c2fb7dd4e19778bb5"},{"id":"eb0ba433-63e5-4a8c-a9f0-27c4192e1336","name":"Enable Proxy Settings","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"A modification registry to enable proxy settings. This technique was seen in DarkGate malware as part of its installation.\n","inputs":{},"dependencies":[],"source_definition_sha256":"bfd6ff771216938f1b91fc4e54e1e49f656b1c462bdc2e6172eec43b4f53a075"},{"id":"ecbd533e-b45d-4239-aeff-b857c6f6d68b","name":"Flush Shimcache","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"The ShimCache is a component in Windows operating systems that stores information about recently executed applications. It is used by the operating system to speed up the launching process of applications. The ShimCache is also used by IR teams and Forensic teams. Forensic investigators can use the ShimCache to determine which programs have been executed on a system, even if they have been deleted or their logs have been cleared.Reference : https://blueteamops.medium.com/shimcache-flush-89daff28d15e","inputs":{},"dependencies":[],"source_definition_sha256":"1f9d68f128a4acea54870b639e52513a268138984a61bcf93ced4a398dc1b374"},{"id":"f2915249-4485-42e2-96b7-9bf34328d497","name":"Abusing MyComputer Disk Cleanup Path for Persistence","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Replacing the registry settings with custom executable will end up with the replacement programs being executed at the time OS will decide to kick off the respective activity\n","inputs":{},"dependencies":[],"source_definition_sha256":"0aff1da415de7bd655b935cb029a4a3c71909faa4bb76341ee02bab908e8b18d"},{"id":"f3a6cceb-06c9-48e5-8df8-8867a6814245","name":"Change Powershell Execution Policy to Bypass","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Attackers need to change the powershell execution policy in order to run their malicious powershell scripts.\nThey can either specify it during the execution of the powershell script or change the registry value for it.\n","inputs":{"default_execution_policy":{"description":"Specify the default poweshell execution policy","type":"string","default":"Default"}},"dependencies":[],"source_definition_sha256":"1339a02047ff9fa163ff5c14047303e22b8719280eb0f6eee7e6302106b94ec1"},{"id":"fe7974e5-5813-477b-a7bd-311d4f535e83","name":"Enabling Restricted Admin Mode via Command_Prompt","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Enabling Restricted Admin Mode via Command_Prompt,enables an attacker to perform a pass-the-hash attack using RDP.\n\nSee [Passing the Hash with Remote Desktop](https://www.kali.org/blog/passing-hash-remote-desktop/)\n","inputs":{},"dependencies":[],"source_definition_sha256":"93d13a80c630a50839abfeb23b632cdc865f971944a35b8d3a8d500cc4111a11"},{"id":"ffbb407e-7f1d-4c95-b22e-548169db1fbd","name":"Activate Windows NoFind Group Policy Feature","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Modify the registry of the currently logged in user using reg.exe via cmd console to Remove Search menu from Start Menu Group Policy.\nTake note that some Group Policy changes might require a restart to take effect.\nSee how Trojan abuses this technique- https://www.sophos.com/de-de/threat-center/threat-analyses/viruses-and-spyware/Troj~Krotten-N/detailed-analysis\n","inputs":{},"dependencies":[],"source_definition_sha256":"6f861fd978b9a8af3a30c0629773787bb74c56955fb5654624aef7f9146c0e7a"},{"id":"ffeddced-bb9f-49c6-97f0-3d07a509bf94","name":"Activities To Disable Microsoft [FIDO Aka Fast IDentity Online] Authentication Detected By Modified Registry Value.","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml","description":"Detect the Microsoft FIDO authentication disable activities that adversary attempt to gains access to login credentials (e.g., passwords), they may be able to impersonate the user and access sensitive accounts or data and also increases the risk of falling victim to phishing attacks.\nSee the related article (https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.FidoAuthentication::AllowFidoDeviceSignon).\n","inputs":{},"dependencies":[],"source_definition_sha256":"8f8d66cfc0cb115a54f4ac1596b147a3c265387cfbcbcd1f1676a5666caa7a2e"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1027":"/ttp-simulation/techniques/enterprise/T1027/","T1078":"/ttp-simulation/techniques/enterprise/T1078/","T1021.002":"/ttp-simulation/techniques/enterprise/T1021.002/","T1112":"/ttp-simulation/techniques/enterprise/T1112/","T1543.003":"/ttp-simulation/techniques/enterprise/T1543.003/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1112","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0063","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Mode","event_type":"SetValue","value_type":"DWORD","value":1}}]}}