T1112 Modify Registry — Attack Simulation

DC0032 collection page — Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_guid, image, parent_image, command_line, user.

<EventFiltering>
  <ProcessCreate onmatch="include">
    <Image condition="is">C:\Windows\System32\whoami.exe</Image>
  </ProcessCreate>
</EventFiltering>

This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0032",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_guid": "lab-process-001",
    "image": "C:\\Windows\\System32\\whoami.exe",
    "parent_image": "C:\\Windows\\System32\\cmd.exe",
    "command_line": "whoami",
    "user": "LAB\\analyst"
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

DC0063 collection page — Use RegistryEvent 13 for value-set and 14 for rename; compare against intended policy and keep original type/value where available.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• Keep this Windows-specific source separate from other operating systems; there is no direct cross-platform event-ID equivalence.

Required normalized fields: registry_path, event_type, value_type, value.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0063",
  "collector": "illustrative-lab-collector",
  "observation": {
    "registry_path": "HKCU\\Software\\Lab\\Mode",
    "event_type": "SetValue",
    "value_type": "DWORD",
    "value": 1
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

MITRE detection strategy

78 exact-tagged source rules. A source tag is a discovery aid, not a relevance verdict. Check the observation point and actual condition of each rule.

• Remote Registry Lateral Movement — test; product: rpc_firewall; category: application; definition: Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:338cd001-2244-31f1-aaaa-900038001003".
• ETW Logging Disabled In .NET Processes - Registry — test; product: windows; service: security.
• NetNTLM Downgrade Attack — test; product: windows; service: security; definition: Requirements: Audit Policy : Object Access > Audit Registry (Success).
• Sysmon Channel Reference Deletion — test; product: windows; service: security.
• Registry Modification Attempt Via VBScript - PowerShell — experimental; category: ps_script; product: windows.
• New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE — test; category: process_creation; product: windows.
• Security Event Logging Disabled via MiniNt Registry Key - Process — experimental; category: process_creation; product: windows.
• Potentially Suspicious Desktop Background Change Using Reg.EXE — test; product: windows; category: process_creation.
• Potential Suspicious Registry File Imported Via Reg.EXE — test; category: process_creation; product: windows.
• RestrictedAdminMode Registry Value Tampering - ProcCreation — test; product: windows; category: process_creation.
• Enable LM Hash Storage - ProcCreation — test; product: windows; category: process_creation.
• Potential Tampering With RDP Related Registry Keys Via Reg.EXE — test; product: windows; category: process_creation.
• Reg Add Suspicious Paths — test; category: process_creation; product: windows.
• Imports Registry Key From a File — test; category: process_creation; product: windows.
• Imports Registry Key From an ADS — test; category: process_creation; product: windows.
• Suspicious Registry Modification From ADS Via Regini.EXE — test; category: process_creation; product: windows.
• Registry Modification Via Regini.EXE — test; category: process_creation; product: windows.
• ShimCache Flush — stable; category: process_creation; product: windows.
• Run Once Task Execution as Configured in Registry — test; product: windows; category: process_creation.
• Non-privileged Usage of Reg or Powershell — test; category: process_creation; product: windows.
• Registry Modification of MS-settings Protocol Handler — test; category: process_creation; product: windows.
• User Shell Folders Registry Modification via CommandLine — experimental; category: process_creation; product: windows.
• Registry Modification Attempt Via VBScript — experimental; category: process_creation; product: windows.
• Suspicious VBoxDrvInst.exe Parameters — test; category: process_creation; product: windows.
• Registry Manipulation via WMI Stdregprov — experimental; category: process_creation; product: windows.
• Terminal Server Client Connection History Cleared - Registry — test; category: registry_delete; product: windows.
• Removal of Potential COM Hijacking Registry Keys — test; product: windows; category: registry_delete.
• Disable Security Events Logging Adding Reg Key MiniNt — test; category: registry_event; product: windows.
• Wdigest CredGuard Registry Modification — test; category: registry_event; product: windows.
• Registry Entries For Azorult Malware — test; product: windows; category: registry_event.
• Potential Qakbot Registry Activity — test; category: registry_event; product: windows.
• NetNTLM Downgrade Attack - Registry — test; product: windows; category: registry_event.
• RedMimicry Winnti Playbook Registry Manipulation — test; product: windows; category: registry_event.
• Run Once Task Configuration in Registry — test; product: windows; category: registry_event.
• Registry Tampering by Potentially Suspicious Processes — experimental; category: registry_event; product: windows.
• Allow RDP Remote Assistance Feature — test; category: registry_set; product: windows.
• New BgInfo.EXE Custom DB Path Registry Configuration — test; category: registry_set; product: windows.
• New BgInfo.EXE Custom VBScript Registry Configuration — test; category: registry_set; product: windows.
• New BgInfo.EXE Custom WMI Query Registry Configuration — test; category: registry_set; product: windows.
• ClickOnce Trust Prompt Tampering — test; category: registry_set; product: windows.
• CrashControl CrashDump Disabled — test; product: windows; category: registry_set.
• Security Event Logging Disabled via MiniNt Registry Key - Registry Set — experimental; category: registry_set; product: windows.
• Service Binary in Suspicious Folder — test; category: registry_set; product: windows.
• Potentially Suspicious Desktop Background Change Via Registry — test; product: windows; category: registry_set.
• DHCP Callout DLL Installation — test; category: registry_set; product: windows.
• Disable Internal Tools or Feature in Registry — test; category: registry_set; product: windows.
• Disable Windows Security Center Notifications — test; category: registry_set; product: windows.
• Windows Event Log Access Tampering Via Registry — experimental; category: registry_set; product: windows.
• Add DisallowRun Execution to Registry — test; category: registry_set; product: windows.
• DNS-over-HTTPS Enabled by Registry — test; product: windows; category: registry_set.
• New DNS ServerLevelPluginDll Installed — test; product: windows; category: registry_set.
• ETW Logging Disabled In .NET Processes - Sysmon Registry — test; product: windows; category: registry_set.
• Change User Account Associated with the FAX Service — test; product: windows; category: registry_set.
• Change the Fax Dll — test; product: windows; category: registry_set.
• Registry Hide Function from User — test; category: registry_set; product: windows.
• RestrictedAdminMode Registry Value Tampering — test; product: windows; category: registry_set.
• NET NGenAssemblyUsageLog Registry Key Tamper — test; product: windows; category: registry_set.
• Trust Access Disable For VBApplications — test; category: registry_set; product: windows.
• Outlook EnableUnsafeClientMailRules Setting Enabled - Registry — test; category: registry_set; product: windows.
• Macro Enabled In A Potentially Suspicious Document — test; category: registry_set; product: windows.
• Uncommon Microsoft Office Trusted Location Added — test; category: registry_set; product: windows.
• Office Macros Warning Disabled — test; category: registry_set; product: windows.
• Potential Persistence Via Custom Protocol Handler — test; category: registry_set; product: windows.
• Potential Persistence Via Event Viewer Events.asp — test; category: registry_set; product: windows.
• Modification of IE Registry Settings — test; category: registry_set; product: windows.
• Potential Persistence Via Outlook Home Page — test; product: windows; category: registry_set.
• Potential Persistence Via Outlook Today Page — test; product: windows; category: registry_set.
• Registry Modification for OCI DLL Redirection — experimental; category: registry_set; product: windows.
• PowerShell Logging Disabled Via Registry Key Tampering — test; category: registry_set; product: windows.
• ETW Logging Disabled For rpcrt4.dll — test; product: windows; category: registry_set.
• ETW Logging Disabled For SCM — test; product: windows; category: registry_set.
• Registry Explorer Policy Modification — test; category: registry_set; product: windows.
• Activate Suppression of Windows Security Center Notifications — test; category: registry_set; product: windows.
• Enable LM Hash Storage — test; product: windows; category: registry_set.
• RDP Sensitive Settings Changed to Zero — test; category: registry_set; product: windows.
• RDP Sensitive Settings Changed — test; category: registry_set; product: windows.
• Wdigest Enable UseLogonCredential — test; category: registry_set; product: windows.
• Winlogon AllowMultipleTSSessions Enable — test; category: registry_set; product: windows.

• S0011 Taidoor — malware.

  Taidoor has the ability to modify the Registry on compromised hosts using <code>RegDeleteValueA</code> and <code>RegCreateKeyExA</code>.[CISA MAR-10292089-1.v2 TAIDOOR August 2021]

  Exact relationship: relationship--2e8e6362-ce7e-4fd5-8c9b-8b85b6f35a58
• S0012 PoisonIvy — malware.

  PoisonIvy creates a Registry subkey that registers a new system device.[Symantec Darkmoon Aug 2005]

  Exact relationship: relationship--19161920-e6b5-481f-a240-62f05c624010
• S0013 PlugX — malware.

  PlugX has a module to create, delete, or modify Registry keys.[Eset PlugX Korplug Mustang Panda March 2022][CIRCL PlugX March 2013][DOJ Affidavit Search and Seizure PlugX December 2024]

  Exact relationship: relationship--067ece2b-4e66-437f-88e0-8dc3f076331b
• S0019 Regin — malware.

  Regin appears to have functionality to modify remote Registry information.[Kaspersky Regin]

  Exact relationship: relationship--fe3c4134-ddef-45f8-b83a-6865a01b9764
• S0022 Uroburos — malware.

  Uroburos can store configuration information in the Registry including the initialization vector and AES key needed to find and decrypt other Uroburos components.[Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023]

  Exact relationship: relationship--61360c2f-0a26-49ca-ac7c-2758fcd26ea2
• S0023 CHOPSTICK — malware.

  CHOPSTICK may modify Registry keys to store RC4 encrypted configuration information.[FireEye APT28]

  Exact relationship: relationship--40a8f80d-5497-4218-849c-3c0b63796641
• S0031 BACKSPACE — malware.

  BACKSPACE is capable of deleting Registry keys, sub-keys, and values on a victim system.[FireEye APT30]

  Exact relationship: relationship--2dec6ce1-e459-4266-86d5-f336ab056f17
• S0032 gh0st RAT — malware.

  gh0st RAT has altered the InstallTime subkey.[Gh0stRAT ATT March 2019]

  Exact relationship: relationship--0f4c2cab-c3ca-4f31-8557-485248b65761
• S0045 ADVSTORESHELL — malware.

  ADVSTORESHELL is capable of setting and deleting Registry values.[Bitdefender APT28 Dec 2015]

  Exact relationship: relationship--a71256aa-a2e3-447c-ba4e-004ba4f062b2
• S0075 Reg — tool.

  Reg may be used to interact with and modify the Windows Registry of a local or remote system at the command-line interface.[Microsoft Reg]

  Exact relationship: relationship--baabf444-1748-472f-b991-7a5b25e4e1bb
• S0090 Rover — malware.

  Rover has functionality to remove Registry Run key persistence as a cleanup procedure.[Palo Alto Rover]

  Exact relationship: relationship--bad90106-a150-4d76-b39f-f35aab4ac766
• S0115 Crimson — malware.

  Crimson can set a Registry key to determine how long it has been installed and possibly to indicate the version number.[Proofpoint Operation Transparent Tribe March 2016]

  Exact relationship: relationship--924b50b9-7de3-4036-b732-c87d08971122
• S0126 ComRAT — malware.

  ComRAT has modified Registry values to store encrypted orchestrator code and payloads.[ESET ComRAT May 2020][CISA ComRAT Oct 2020]

  Exact relationship: relationship--c2496cf4-b502-44cf-ae85-efb9b882a4b1
• S0140 Shamoon — malware.

  Once Shamoon has access to a network share, it enables the RemoteRegistry service on the target system. It will then connect to the system with RegConnectRegistryW and modify the Registry to disable UAC remote restrictions by setting <code>SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy</code> to 1.[FireEye Shamoon Nov 2016][Palo Alto Shamoon Nov 2016][McAfee Shamoon December 2018]

  Exact relationship: relationship--af9347a3-00a9-4ece-b075-8c55bd4f4b9b
• S0142 StreamEx — malware.

  StreamEx has the ability to modify the Registry.[Cylance Shell Crew Feb 2017]

  Exact relationship: relationship--69bff194-c90e-4e30-a369-57da4cff014d
• S0148 RTM — malware.

  RTM can delete all Registry entries created during its execution.[ESET RTM Feb 2017]

  Exact relationship: relationship--94b4de9a-1f83-4923-8d4b-e9bafdb1bef9
• S0154 Cobalt Strike — malware.

  Cobalt Strike can modify Registry values within <code>HKEY_CURRENT_USER\Software\Microsoft\Office\<Excel Version>\Excel\Security\AccessVBOM\</code> to enable the execution of additional code.[Talos Cobalt Strike September 2020]

  Exact relationship: relationship--45376fe9-2a43-4e09-942e-82be661ed572
• S0157 SOUNDBITE — malware.

  SOUNDBITE is capable of modifying the Registry.[FireEye APT32 May 2017]

  Exact relationship: relationship--6592447f-31c8-46d0-8e88-47584fa301f0
• S0158 PHOREAL — malware.

  PHOREAL is capable of manipulating the Registry.[FireEye APT32 May 2017]

  Exact relationship: relationship--202b96f6-0f7c-4aed-8004-780f1d880059
• S0180 Volgmer — malware.

  Volgmer modifies the Registry to store an encoded configuration file in <code>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Security</code>.[US-CERT Volgmer 2 Nov 2017][Symantec Volgmer Aug 2014]

  Exact relationship: relationship--bd8fec61-37c8-489b-a74b-424ff85222ad
• S0198 NETWIRE — malware.

  NETWIRE can modify the Registry to store its configuration information.[Red Canary NETWIRE January 2020]

  Exact relationship: relationship--e0c53a14-01d3-42f6-9dea-6cb60ac72025
• S0203 Hydraq — malware.

  Hydraq creates a Registry subkey to register its created service, and can also uninstall itself later by deleting this value. Hydraq's backdoor also enables remote attackers to modify and delete subkeys.[Symantec Trojan.Hydraq Jan 2010][Symantec Hydraq Jan 2010]

  Exact relationship: relationship--541855dd-0249-4f63-8e95-0024f760484e
• S0205 Naid — malware.

  Naid creates Registry entries that store information about a created service and point to a malicious DLL dropped to disk.[Symantec Naid June 2012]

  Exact relationship: relationship--aea0804f-e322-401f-a012-c16c25e0ac70
• S0210 Nerex — malware.

  Nerex creates a Registry subkey that registers a new service.[Symantec Nerex May 2012]

  Exact relationship: relationship--f7ded6a1-043e-437a-8a0c-00ded73e5289
• S0229 Orz — malware.

  Orz can perform Registry operations.[Proofpoint Leviathan Oct 2017]

  Exact relationship: relationship--93addaa1-7baa-4fdd-ab92-3e58865a5ef2
• S0239 Bankshot — malware.

  Bankshot writes data into the Registry key <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Pniumj</code>.[US-CERT Bankshot Dec 2017]

  Exact relationship: relationship--c0d119a2-c5f9-4c18-a18c-28bfa576ea9a
• S0240 ROKRAT — malware.

  ROKRAT can modify the `HKEY_CURRENT_USER\Software\Microsoft\Office\` registry key so it can bypass the VB object model (VBOM) on a compromised host.[Malwarebytes RokRAT VBA January 2021]

  Exact relationship: relationship--0ae212be-c07b-4f62-8c5e-9dfc0472254e
• S0242 SynAck — malware.

  SynAck can manipulate Registry keys.[SecureList SynAck Doppelgänging May 2018]

  Exact relationship: relationship--109b2118-d714-41bb-a39d-b1fd1b755b55
• S0245 BADCALL — malware.

  BADCALL modifies the firewall Registry key <code>SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfileGloballyOpenPorts\\List</code>.[US-CERT BADCALL]

  Exact relationship: relationship--7e559e10-483a-42ca-8ddf-d8ca04ed8bd2
• S0254 PLAINTEE — malware.

  PLAINTEE uses <code>reg add</code> to add a Registry Run key for persistence.[Rancor Unit42 June 2018]

  Exact relationship: relationship--5bbe7733-4e20-4ee1-a29c-b8e7111781dd
• S0256 Mosquito — malware.

  Mosquito can modify Registry keys under <code>HKCU\Software\Microsoft\[dllname]</code> to store configuration values. Mosquito also modifies Registry keys under <code>HKCR\CLSID\...\InprocServer32</code> with a path to the launcher.[ESET Turla Mosquito Jan 2018]

  Exact relationship: relationship--67e6b603-a45d-4cbc-9b3e-546392934f7f
• S0260 InvisiMole — malware.

  InvisiMole has a command to create, set, copy, or delete a specified Registry key or value.[ESET InvisiMole June 2018][ESET InvisiMole June 2020]

  Exact relationship: relationship--66f5e718-f910-487f-852a-98a8d752b0ba
• S0261 Catchamas — malware.

  Catchamas creates three Registry keys to establish persistence by adding a Windows Service.[Symantec Catchamas April 2018]

  Exact relationship: relationship--0dd74596-509c-4669-9d29-e1fb501c9c70
• S0262 QuasarRAT — tool.

  QuasarRAT has a command to edit the Registry on the victim’s machine.[GitHub QuasarRAT][CISA AR18-352A Quasar RAT December 2018]

  Exact relationship: relationship--53e09f15-3162-4480-8eb4-709e9c18d7fb
• S0263 TYPEFRAME — malware.

  TYPEFRAME can install encrypted configuration data under the Registry key <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\laxhost.dll</code> and <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PrintConfigs</code>.[US-CERT TYPEFRAME June 2018]

  Exact relationship: relationship--ceb66bd9-3e75-4559-a0b9-3339a926cde6
• S0266 TrickBot — malware.

  TrickBot can modify registry entries.[Trend Micro Trickbot Nov 2018]

  Exact relationship: relationship--c75ec383-2acd-479f-b9b7-b2038ec10a7d
• S0267 FELIXROOT — malware.

  FELIXROOT deletes the Registry key <code>HKCU\Software\Classes\Applications\rundll32.exe\shell\open</code>.[FireEye FELIXROOT July 2018]

  Exact relationship: relationship--321c1e2e-c295-42db-87cf-4d71f6c7f164
• S0268 Bisonal — malware.

  Bisonal has deleted Registry keys to clean up its prior activity.[Talos Bisonal Mar 2020]

  Exact relationship: relationship--8edfde6c-1ede-41eb-bc84-0d98fe24bebd
• S0269 QUADAGENT — malware.

  QUADAGENT modifies an HKCU Registry key to store a session identifier unique to the compromised system as well as a pre-shared key used for encrypting and decrypting C2 communications.[Unit 42 QUADAGENT July 2018]

  Exact relationship: relationship--e0999d7e-deec-446b-a86b-4c8988e20a96
• S0271 KEYMARBLE — malware.

  KEYMARBLE has a command to create Registry entries for storing data under <code>HKEY_CURRENT_USER\SOFTWARE\Microsoft\WABE\DataPath</code>.[US-CERT KEYMARBLE Aug 2018]

  Exact relationship: relationship--d4f0554e-46bb-4fd5-94e8-900dfe3198cf
• S0330 Zeus Panda — malware.

  Zeus Panda modifies several Registry keys under <code>HKCU\Software\Microsoft\Internet Explorer\ PhishingFilter\</code> to disable phishing filters.[GDATA Zeus Panda June 2017]

  Exact relationship: relationship--a9a0ecce-239c-4666-94e9-ef1fb64cf796
• S0331 Agent Tesla — malware.

  Agent Tesla can achieve persistence by modifying Registry key entries.[SentinelLabs Agent Tesla Aug 2020]

  Exact relationship: relationship--d9cd513e-c863-4695-a6e0-b2e4e79c24e8
• S0332 Remcos — tool.

  Remcos has full control of the Registry, including the ability to modify it.[Riskiq Remcos Jan 2018][Fortinet Remcos Campaign NOV 2024]

  Exact relationship: relationship--66f2f7b3-3df9-4d4a-bedc-ecacac3039e8
• S0334 DarkComet — malware.

  DarkComet adds a Registry value for its installation routine to the Registry Key <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System Enable LUA=”0”</code> and <code>HKEY_CURRENT_USER\Software\DC3_FEXEC</code>.[TrendMicro DarkComet Sept 2014][Malwarebytes DarkComet March 2018]

  Exact relationship: relationship--c88e7db9-47b1-4fe9-943a-98ebde29980b
• S0336 NanoCore — malware.

  NanoCore has the capability to edit the Registry.[DigiTrust NanoCore Jan 2017][PaloAlto NanoCore Feb 2016]

  Exact relationship: relationship--a21afd42-09ae-4e6b-a065-dc1b4454216d
• S0342 GreyEnergy — malware.

  GreyEnergy modifies conditions in the Registry and adds keys.[ESET GreyEnergy Oct 2018]

  Exact relationship: relationship--b7dfc429-1f62-4bb1-933f-25dfd4fff9ad
• S0343 Exaramel for Windows — malware.

  Exaramel for Windows adds the configuration to the Registry in XML format.[ESET TeleBots Oct 2018]

  Exact relationship: relationship--ab11615f-a0d9-43c9-b71e-6ae83155bf3b
• S0348 Cardinal RAT — malware.

  Cardinal RAT sets <code>HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load</code> to point to its executable.[PaloAlto CardinalRat Apr 2017]

  Exact relationship: relationship--d7983dcd-1970-4d84-82e7-a61d2125caeb
• S0350 zwShell — malware.

  zwShell can modify the Registry.[McAfee Night Dragon]

  Exact relationship: relationship--9fbc10b3-f72e-4cc8-9e94-34c6404c3a1f
• S0356 KONNI — malware.

  KONNI has modified registry keys of ComSysApp, Svchost, and xmlProv on the machine to gain persistence.[Medium KONNI Jan 2020][Malwarebytes Konni Aug 2021]

  Exact relationship: relationship--7431e309-f379-45a5-ae7d-0520f6b17a94
• S0376 HOPLIGHT — malware.

  HOPLIGHT has modified Managed Object Format (MOF) files within the Registry to run specific commands and create persistence on the system.[US-CERT HOPLIGHT Apr 2019]

  Exact relationship: relationship--0cf14628-b4c0-470a-9059-43fc562717d8
• S0385 njRAT — malware.

  njRAT can create, delete, or modify a specified Registry key or value.[Fidelis njRAT June 2013][Trend Micro njRAT 2018]

  Exact relationship: relationship--b2cf7d18-daa0-45a1-b2c1-6b6056bb19c4
• S0386 Ursnif — malware.

  Ursnif has used Registry modifications as part of its installation routine.[TrendMicro BKDR_URSNIF.SM][ProofPoint Ursnif Aug 2016]

  Exact relationship: relationship--a6252cbd-82a6-4cd6-a5f6-74507cd49f72
• S0397 LoJax — malware.

  LoJax has modified the Registry key <code>‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute’</code> from <code>‘autocheck autochk *’</code> to <code>‘autocheck autoche *’</code>.[ESET LoJax Sept 2018]

  Exact relationship: relationship--1f5c6a39-aa0b-469e-aabe-67e4d237b213
• S0412 ZxShell — malware.

  ZxShell can create Registry entries to enable services to run.[Talos ZxShell Oct 2014]

  Exact relationship: relationship--713495d9-e481-4f48-af72-e3bfd474016b
• S0428 PoetRAT — malware.

  PoetRAT has made registry modifications to alter its behavior upon execution.[Talos PoetRAT April 2020]

  Exact relationship: relationship--2606ed25-9f1d-4e85-822a-af39ce0d8e66
• S0438 Attor — malware.

  Attor's dispatcher can modify the Run registry key.[ESET Attor Oct 2019]

  Exact relationship: relationship--6d39de5f-6fbd-43e3-8da8-03a4cbe46656
• S0441 PowerShower — malware.

  PowerShower has added a registry key so future powershell.exe instances are spawned off-screen by default, and has removed all registry entries that are left behind during the dropper process.[Unit 42 Inception November 2018]

  Exact relationship: relationship--a679be02-156a-4e02-bfa5-ce07b60d147b
• S0444 ShimRat — malware.

  ShimRat has registered two registry keys for shim databases.[FOX-IT May 2016 Mofang]

  Exact relationship: relationship--f81b567d-9fd3-44f4-bd6b-9ba6f386609e
• S0447 Lokibot — malware.

  Lokibot has modified the Registry as part of its UAC bypass process.[Talos Lokibot Jan 2021]

  Exact relationship: relationship--710919f6-2c74-4f41-be51-af848ad691af
• S0455 Metamorfo — malware.

  Metamorfo has written process names to the Registry, disabled IE browser features, deleted Registry keys, and changed the ExtendedUIHoverTime key.[Medium Metamorfo Apr 2020][Fortinet Metamorfo Feb 2020][FireEye Metamorfo Apr 2018][ESET Casbaneiro Oct 2019]

  Exact relationship: relationship--676c5a2a-323b-4166-9c83-8c6e5e25bb1f
• S0457 Netwalker — malware.

  Netwalker can add the following registry entry: <code>HKEY_CURRENT_USER\SOFTWARE\{8 random characters}</code>.[TrendMicro Netwalker May 2020]

  Exact relationship: relationship--0775a1ba-c95a-472e-ab1c-d21108acc907
• S0467 TajMahal — malware.

  TajMahal can set the <code>KeepPrintedJobs</code> attribute for configured printers in <code>SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Print\\Printers</code> to enable document stealing.[Kaspersky TajMahal April 2019]

  Exact relationship: relationship--91c175b7-5c8e-4534-82b1-9bdb1b709a34
• S0476 Valak — malware.

  Valak has the ability to modify the Registry key <code>HKCU\Software\ApplicationContainer\Appsw64</code> to store information regarding the C2 server and downloads.[Cybereason Valak May 2020][Unit 42 Valak July 2020][SentinelOne Valak June 2020]

  Exact relationship: relationship--0841cd91-1151-411f-befc-0204e3a3eb30
• S0488 CrackMapExec — tool.

  CrackMapExec can create a registry key using wdigest.[CME Github September 2018]

  Exact relationship: relationship--99eab281-6555-4aee-9d83-0e97bb3262ef
• S0496 REvil — malware.

  REvil can modify the Registry to save encryption parameters and system information.[Cylance Sodinokibi July 2019][Secureworks GandCrab and REvil September 2019][McAfee Sodinokibi October 2019][Intel 471 REvil March 2020][Secureworks REvil September 2019]

  Exact relationship: relationship--2c927351-d98a-4734-83db-82ad3231e59f
• S0501 PipeMon — malware.

  PipeMon has modified the Registry to store its encrypted payload.[ESET PipeMon May 2020]

  Exact relationship: relationship--33823f15-f43f-41ef-bc14-7dea2ab21acf
• S0511 RegDuke — malware.

  RegDuke can create seemingly legitimate Registry key to store its encryption key.[ESET Dukes October 2019]

  Exact relationship: relationship--87630bba-4308-46f2-9601-7d30795a2eb6
• S0517 Pillowmint — malware.

  Pillowmint has modified the Registry key <code>HKLM\SOFTWARE\Microsoft\DRM</code> to store a malicious payload.[Trustwave Pillowmint June 2020]

  Exact relationship: relationship--332ce4cd-311a-457f-ae10-6d8e3ef7bc77
• S0518 PolyglotDuke — malware.

  PolyglotDuke can write encrypted JSON configuration files to the Registry.[ESET Dukes October 2019]

  Exact relationship: relationship--190057d5-13ad-40d2-a2f0-0177850e2905
• S0527 CSPY Downloader — tool.

  CSPY Downloader can write to the Registry under the <code>%windir%</code> variable to execute tasks.[Cybereason Kimsuky November 2020]

  Exact relationship: relationship--4d58ff48-b6d8-48ba-aa29-2f34d4dc1264
• S0531 Grandoreiro — malware.

  Grandoreiro can modify the Registry to store its configuration at `HKCU\Software\` under frequently changing names including <code>%USERNAME%</code> and <code>ToolTech-RM</code>.[ESET Grandoreiro April 2020]

  Exact relationship: relationship--2e53dad4-17cc-4fe6-a3b9-d622075d78f7
• S0533 SLOTHFULMEDIA — malware.

  SLOTHFULMEDIA can add, modify, and/or delete registry keys. It has changed the proxy configuration of a victim system by modifying the <code>HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap</code> registry.[CISA MAR SLOTHFULMEDIA October 2020]

  Exact relationship: relationship--10fb2420-a482-4909-90c6-fd9f7e5c24a6
• S0537 HyperStack — malware.

  HyperStack can add the name of its communication pipe to <code>HKLM\SYSTEM\\CurrentControlSet\\Services\\lanmanserver\\parameters\NullSessionPipes</code>.[Accenture HyperStack October 2020]

  Exact relationship: relationship--91f7282f-e496-462d-9fd5-6cf4d0170e91
• S0559 SUNBURST — malware.

  SUNBURST had commands that allow an attacker to write or delete registry keys, and was observed stopping services by setting their <code>HKLM\SYSTEM\CurrentControlSet\services\\[service_name]\\Start</code> registry entries to value 4.[FireEye SUNBURST Backdoor December 2020][Microsoft Analyzing Solorigate Dec 2020] It also deleted previously-created Image File Execution Options (IFEO) Debugger registry values and registry keys related to HTTP proxy to clean up traces of its activity.[Microsoft Deep Dive Solorigate January 2021]

  Exact relationship: relationship--15cd99f1-29b4-4603-ae74-fdc204afead4
• S0560 TEARDROP — malware.

  TEARDROP modified the Registry to create a Windows service for itself on a compromised host.[Check Point Sunburst Teardrop December 2020]

  Exact relationship: relationship--69356661-76fb-46fe-94ce-d029ee7f8a64
• S0568 EVILNUM — malware.

  EVILNUM can make modifications to the Regsitry for persistence.[Prevailion EvilNum May 2020]

  Exact relationship: relationship--a7c6693e-d1e2-4396-982f-85978c9b97a3
• S0569 Explosive — malware.

  Explosive has a function to write itself to Registry values.[CheckPoint Volatile Cedar March 2015]

  Exact relationship: relationship--178116a9-6ac9-45c0-bc74-36fe9ba12686
• S0570 BitPaymer — malware.

  BitPaymer can set values in the Registry to help in execution.[Crowdstrike Indrik November 2018]

  Exact relationship: relationship--e811f6e8-a736-4bb8-8cd9-c6edc9a7ebd8
• S0572 Caterpillar WebShell — malware.

  Caterpillar WebShell has a command to modify a Registry key.[ClearSky Lebanese Cedar Jan 2021]

  Exact relationship: relationship--8ecc61b0-c0b9-4f3a-a6b4-53c88e1d9bb7
• S0576 MegaCortex — malware.

  MegaCortex has added entries to the Registry for ransom contact information.[IBM MegaCortex]

  Exact relationship: relationship--83d63b2b-f287-4047-bbe4-82c8b100222a
• S0579 Waterbear — malware.

  Waterbear has deleted certain values from the Registry to load a malicious DLL.[Trend Micro Waterbear December 2019]

  Exact relationship: relationship--631ba90c-982c-4415-a13c-75cf06e53252
• S0583 Pysa — malware.

  Pysa has modified the registry key “SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System” and added the ransom note.[CERT-FR PYSA April 2020]

  Exact relationship: relationship--7a097ec6-c379-4aef-849e-fe7d9ea1e7d1
• S0589 Sibot — malware.

  Sibot has modified the Registry to install a second-stage script in the <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\sibot</code>.[MSTIC NOBELIUM Mar 2021]

  Exact relationship: relationship--e41eea8b-20d6-4050-96e6-6b59670f6e65
• S0596 ShadowPad — malware.

  ShadowPad can modify the Registry to store and maintain a configuration block and virtual file system.[Kaspersky ShadowPad Aug 2017][TrendMicro EarthLusca 2022]

  Exact relationship: relationship--072c3b1d-1ad6-447e-9512-2c6bc6e797fd
• S0603 Stuxnet — malware.

  Stuxnet can create registry keys to load driver files.[Nicolas Falliere, Liam O Murchu, Eric Chien February 2011]

  Exact relationship: relationship--2f11e661-a5a0-4420-b97e-b080fc4fa441
• S0608 Conficker — malware.

  Conficker adds keys to the Registry at <code>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services</code> and various other Registry locations.[SANS Conficker][Trend Micro Conficker]

  Exact relationship: relationship--150667a8-2155-4500-b7bb-c2d6bbc568b8
• S0611 Clop — malware.

  Clop can make modifications to Registry keys.[Cybereason Clop Dec 2020]

  Exact relationship: relationship--a5c59466-b7ac-44a0-804d-cdfbc88c8fba
• S0612 WastedLocker — malware.

  WastedLocker can modify registry values within the <code>Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap</code> registry key.[NCC Group WastedLocker June 2020]

  Exact relationship: relationship--519beaec-1b79-42d7-9739-8c22e896e0cd
• S0631 Chaes — malware.

  Chaes can modify Registry values to stored information and establish persistence.[Cybereason Chaes Nov 2020]

  Exact relationship: relationship--9fde7504-bd24-46f5-88d7-4afcb8d37f4a
• S0640 Avaddon — malware.

  Avaddon modifies several registry keys for persistence and UAC bypass.[Arxiv Avaddon Feb 2021]

  Exact relationship: relationship--c27ceec5-2eaf-4b3b-8120-9fb691d6458b
• S0649 SMOKEDHAM — malware.

  SMOKEDHAM has modified registry keys for persistence, to enable credential caching for credential access, and to facilitate lateral movement via RDP.[FireEye SMOKEDHAM June 2021]

  Exact relationship: relationship--331f7990-d817-49ec-9d55-c4c64da7f4a6
• S0650 QakBot — malware.

  QakBot can modify the Registry to store its configuration information in a randomly named subkey under <code>HKCU\Software\Microsoft</code>.[Red Canary Qbot][Group IB Ransomware September 2020]

  Exact relationship: relationship--c039483a-5e0f-47be-b614-0d766eda9e0f
• S0660 Clambling — malware.

  Clambling can set and delete Registry keys.[Trend Micro DRBControl February 2020]

  Exact relationship: relationship--bef96df2-cc94-414d-8144-4c4875c59751
• S0662 RCSession — malware.

  RCSession can write its configuration file to the Registry.[Trend Micro DRBControl February 2020][Profero APT27 December 2020]

  Exact relationship: relationship--ec72af45-d362-41c1-99d1-7a225a823049
• S0663 SysUpdate — malware.

  SysUpdate can write its configuration file to <code>Software\Classes\scConfig</code> in either <code>HKEY_LOCAL_MACHINE</code> or <code>HKEY_CURRENT_USER</code>.[Trend Micro Iron Tiger April 2021]

  Exact relationship: relationship--b01341a2-dacf-4780-acf9-3325f8597409
• S0664 Pandora — malware.

  Pandora can write an encrypted token to the Registry to enable processing of remote commands.[Trend Micro Iron Tiger April 2021]

  Exact relationship: relationship--ff495a54-08f1-4b0f-b44d-6bbeb5240225
• S0665 ThreatNeedle — malware.

  ThreatNeedle can modify the Registry to save its configuration data as the following RC4-encrypted Registry key: `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\GameCon`.[Kaspersky ThreatNeedle Feb 2021]

  Exact relationship: relationship--a5f5eee7-6cc2-4eb4-b918-fc771b927abc
• S0666 Gelsemium — malware.

  Gelsemium can modify the Registry to store its components.[ESET Gelsemium June 2021]

  Exact relationship: relationship--516712db-0e82-43a5-bd9f-f1a4cb4939c1
• S0668 TinyTurla — malware.

  TinyTurla can set its configuration parameters in the Registry.[Talos TinyTurla September 2021]

  Exact relationship: relationship--2f603550-4368-4f34-89d9-50f69eed2fa9
• S0669 KOCTOPUS — malware.

  KOCTOPUS has added and deleted keys from the Registry.[MalwareBytes LazyScripter Feb 2021]

  Exact relationship: relationship--1aae3796-86d5-4b31-ad21-e1dcc508a3b5
• S0670 WarzoneRAT — malware.

  WarzoneRAT can create `HKCU\Software\Classes\Folder\shell\open\command` as a new registry key during privilege escalation.[Uptycs Warzone UAC Bypass November 2020][Check Point Warzone Feb 2020]

  Exact relationship: relationship--42a2aec6-4efb-44d0-8ae8-32a208c05da6
• S0673 DarkWatchman — malware.

  DarkWatchman can modify Registry values to store configuration strings, keylogger, and output of components.[Prevailion DarkWatchman 2021]

  Exact relationship: relationship--2e126b9a-f902-4077-963e-64185c9544ff
• S0674 CharmPower — malware.

  CharmPower can remove persistence-related artifacts from the Registry.[Check Point APT35 CharmPower January 2022]

  Exact relationship: relationship--0167fba6-d37d-46ba-bb07-5fc70b864b3f
• S0677 AADInternals — tool.

  AADInternals can modify registry keys as part of setting a new pass-through authentication agent.[AADInternals Documentation]

  Exact relationship: relationship--faa657c6-e223-4b45-8f92-b35fbd76bd56
• S0679 Ferocious — malware.

  Ferocious has the ability to add a Class ID in the current user Registry hive to enable persistence mechanisms.[Kaspersky WIRTE November 2021]

  Exact relationship: relationship--d52b8760-abba-46f0-8c82-653b95cb2775
• S0691 Neoichor — malware.

  Neoichor has the ability to configure browser settings by modifying Registry entries under `HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer`.[Microsoft NICKEL December 2021]

  Exact relationship: relationship--8c29eb34-02dd-42c8-9324-bfad5cde2fc7
• S0692 SILENTTRINITY — tool.

  SILENTTRINITY can modify registry keys, including to enable or disable Remote Desktop Protocol (RDP).[GitHub SILENTTRINITY Modules July 2019]

  Exact relationship: relationship--60202ca3-cadc-4756-99c8-a4b18e07d116
• S0697 HermeticWiper — malware.

  HermeticWiper has the ability to modify Registry keys to disable crash dumps, colors for compressed files, and pop-up information about folders and desktop items.[SentinelOne Hermetic Wiper February 2022][Crowdstrike DriveSlayer February 2022][Qualys Hermetic Wiper March 2022]

  Exact relationship: relationship--41de9761-477c-4674-aea7-64a0b0b4ab4b
• S1011 Tarrask — malware.

  Tarrask is able to delete the Security Descriptor (`SD`) registry subkey in order to “hide” scheduled tasks.[Tarrask scheduled task]

  Exact relationship: relationship--8eb5293f-e310-429c-a801-596feb3903a0
• S1025 Amadey — malware.

  Amadey has overwritten registry keys for persistence.[BlackBerry Amadey 2020]

  Exact relationship: relationship--c2c31b26-7e42-43b6-964b-c959cabc53a4
• S1033 DCSrv — malware.

  DCSrv has created Registry keys for persistence.[Checkpoint MosesStaff Nov 2021]

  Exact relationship: relationship--150f7dbe-3e64-4ee4-a621-6d416e53af63
• S1047 Mori — malware.

  Mori can write data to `HKLM\Software\NFC\IPA` and `HKLM\Software\NFC\` and delete Registry values.[DHS CISA AA22-055A MuddyWater February 2022][CYBERCOM Iranian Intel Cyber January 2022]

  Exact relationship: relationship--b2d24622-d6ee-4a9f-84cc-ecb6efab9625
• S1050 PcShare — tool.

  PcShare can delete its persistence mechanisms from the registry.[Bitdefender FunnyDream Campaign November 2020]

  Exact relationship: relationship--d45fe5a0-f9e5-4f05-b40b-8693c8eab0f7
• S1058 Prestige — malware.

  Prestige has the ability to register new registry keys for a new extension handler via `HKCR\.enc` and `HKCR\enc\shell\open\command`.[Microsoft Prestige ransomware October 2022]

  Exact relationship: relationship--86245eed-44d6-4a2a-ad83-1dd6a700a7be
• S1059 metaMain — malware.

  metaMain can write the process ID of a target process into the `HKEY_LOCAL_MACHINE\SOFTWARE\DDE\tpid` Registry value as part of its reflective loading activity.[SentinelLabs Metador Technical Appendix Sept 2022]

  Exact relationship: relationship--51b34c1f-4e2f-4bb7-98a1-fa90ed873eba
• S1060 Mafalda — malware.

  Mafalda can manipulate the system registry on a compromised host.[SentinelLabs Metador Technical Appendix Sept 2022]

  Exact relationship: relationship--35317fb7-9426-4f6e-9c78-64bb7a2da67f
• S1066 DarkTortilla — malware.

  DarkTortilla has modified registry keys for persistence.[Secureworks DarkTortilla Aug 2022]

  Exact relationship: relationship--d6bb4c39-f4d1-41aa-8b0a-363f198ed6ab
• S1068 BlackCat — malware.

  BlackCat has the ability to add the following registry key on compromised networks to maintain persistence: `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services \LanmanServer\Paramenters`[Microsoft BlackCat Jun 2022]

  Exact relationship: relationship--552afd93-370d-4f8e-b2c0-e27d9d7e050e
• S1070 Black Basta — malware.

  Black Basta has modified the Registry to enable itself to run in safe mode, to change the icons and file extensions for encrypted files, and to add the malware path for persistence.[Minerva Labs Black Basta May 2022][Cyble Black Basta May 2022][Trend Micro Black Basta May 2022][NCC Group Black Basta June 2022][Deep Instinct Black Basta August 2022][Palo Alto Networks Black Basta August 2022]

  Exact relationship: relationship--5abf323d-03be-4996-ab4b-89317883d0ab
• S1090 NightClub — malware.

  NightClub can modify the Registry to set the ServiceDLL for a service created by the malware for persistence.[MoustachedBouncer ESET August 2023]
  

  Exact relationship: relationship--dd0dbfef-065c-47c9-a9e3-ac8d02f7ca42
• S1099 Samurai — malware.

  The Samurai loader component can create multiple Registry keys to force the svchost.exe process to load the final backdoor.[Kaspersky ToddyCat June 2022]

  Exact relationship: relationship--983073e5-9115-46c2-ba78-17e1c111916d
• S1131 NPPSPY — tool.

  NPPSPY modifies the Registry to record the malicious listener for output from the Winlogon process.[Huntress NPPSPY 2022]

  Exact relationship: relationship--58bddfb4-2236-444b-8681-2b2e0fe1f7e2
• S1132 IPsec Helper — malware.

  IPsec Helper can make arbitrary changes to registry keys based on provided input.[SentinelOne Agrius 2021]

  Exact relationship: relationship--70d725a6-f1d8-46e5-b857-b0cbd0249d6b
• S1149 CHIMNEYSWEEP — malware.

  CHIMNEYSWEEP can use the Windows Registry Environment key to change the `%windir%` variable to point to `c:\Windows` to enable payload execution.[Mandiant ROADSWEEP August 2022]
  

  Exact relationship: relationship--ea54979f-3e4c-459c-bfaa-1435e36729e1
• S1178 ShrinkLocker — malware.

  ShrinkLocker modifies various registry keys associated with system logon and BitLocker functionality to effectively lock-out users following disk encryption.[Kaspersky ShrinkLocker 2024][Splunk ShrinkLocker 2024]

  Exact relationship: relationship--52b695ee-33cb-445a-96b1-3fa074318d44
• S1180 BlackByte Ransomware — malware.

  BlackByte Ransomware modifies the victim Registry to prevent system recovery.[Trustwave BlackByte 2021]

  Exact relationship: relationship--c5c1bf20-d215-41cb-a5d2-4388a1ca5e59
• S1181 BlackByte 2.0 Ransomware — malware.

  BlackByte 2.0 Ransomware modifies the victim Registry to allow for elevated execution.[Microsoft BlackByte 2023]

  Exact relationship: relationship--40b51ac6-d391-4fcb-ae32-79705d25301a
• S1190 Kapeka — malware.

  Kapeka writes persistent configuration information to the victim host registry.[WithSecure Kapeka 2024]

  Exact relationship: relationship--60a8cf92-7bd7-4e4a-9681-91d227b2609a
• S1199 LockBit 2.0 — malware.

  LockBit 2.0 can create Registry keys to bypass UAC and for persistence.[FBI Lockbit 2.0 FEB 2022]

  Exact relationship: relationship--5cb4493b-1830-436a-8c1b-5aab2ef37442
• S1201 TRANSLATEXT — malware.

  TRANSLATEXT has modified the following registry key to install itself as the value, granting permission to install specified extensions: ` HKCU\Software\Policies\Google\Chrome\ExtensionInstallForcelist`.[Zscaler Kimsuky TRANSLATEXT]

  Exact relationship: relationship--4a2d2699-a2c0-40e4-8e8d-3450155b9923
• S1202 LockBit 3.0 — malware.

  LockBit 3.0 can change the Registry values for Group Policy refresh time, to disable SmartScreen, and to disable Windows Defender.[Joint Cybersecurity Advisory LockBit 3.0 MAR 2023][INCIBE-CERT LockBit MAR 2024]

  Exact relationship: relationship--1c4a31d0-3567-4081-93f5-14de47eabecf
• S1226 BOOKWORM — malware.

  BOOKWORM has modified Registry key values as part of its created service `DeviceSync`. [Unit42 Bookworm Nov2015]

  Exact relationship: relationship--53d6538d-5b30-4503-94a3-077ddc428a3a
• S1230 HIUPAN — malware.

  HIUPAN has modified registry keys to ensure hidden files and extensions are not visible through the modification of `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced`.[2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA][Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024]

  Exact relationship: relationship--202a6c36-ba18-4615-88ae-a6e0005eda71
• S1242 Qilin — malware.

  Qilin can make Registry modifications to share networked drives between elevated and non-elevated processes and to increase the number of outstanding network requests per client.[Halcyon Qilin.B OCT 2024][Picus Qilin MAR 2025] Qilin can also modify `HKEY_CURRENT_USER\Control Panel\Desktop\Wallpaper` to enable posting of ransom messages.[Cisco Talos Qilin Ransomware OCT 2025]
  

  Exact relationship: relationship--6bbefe61-008f-4298-8a9b-364c51ba7c20
• S1247 Embargo — malware.

  Embargo has modified and deleted Registry keys to add services, and to disable Security Solutions such as Windows Defender.[ESET Embargo Ransomware October 2024]

  Exact relationship: relationship--74e72fff-a4b9-4802-8eab-0555043d7304
• S9023 HiddenFace — malware.

  HiddenFace can store its configuration file in the Registry.[JPCERT MirrorFace JUL 2024]

  Exact relationship: relationship--eb93689a-f815-4d93-ba6d-6104a60d9a9e
• S9025 NOOPLDR — malware.

  NOOPLDR can store its payload in the Registry using a random hex string in `HKCU\SOFTWARE\Microsoft\COM3`.[Trend Micro Earth Kasha NOV 2024]

  Exact relationship: relationship--b75982a3-8ba7-4a30-8ed8-894a1e2f75da
• S9032 MuddyViper — malware.

  MuddyViper has the ability to clear the Registry values in the Windows Startup folder that were previously set for persistence.[ESET_MuddyWater_Dec2025]    

  Exact relationship: relationship--7ac875db-8d72-416b-93cf-2712d376d84e
• S9050 Vidar — malware.

  Vidar has set the Registry value associated with User Access Control (UAC) (i.e. `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA`) to `0`, which disabled UAC.[Logpoint_StealerMalwareFamilies_2024]
  

  Exact relationship: relationship--8e8730bf-a7cd-4c35-9c6a-ae34552fe59c
• S9051 The Gentlemen Ransomware — malware.

  The Gentlemen Ransomware has modified registry keys to allow more permissive access controls to include LSA anonymous access controls.[CheckPointResearch_TheGentlemen_April2026]

  Exact relationship: relationship--a8ead19f-6ea1-48e0-99e3-71ceb0360fcb

Modify the registry of the currently logged in user using reg.exe via cmd console to disable the windows toast notification.
See how azorult malware abuses this technique- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/

Pinned Atomic procedure · 003f466a-6010-4b15-803a-cbb478a314d7 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Disable Auto Update Windows OS feature. Redline is using this as part of its defense evasion.

Pinned Atomic procedure · 01b20ca8-c7a3-4d86-af59-059f15ed5474 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Allow startup key and PIN with TPM for Bitlocker tool

Pinned Atomic procedure · 02d8b9f7-1a51-4011-8901-2d55cca667f9 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

A modification registry to disable ShowUI settings of Windows Error Report. This registry setting can influence the behavior of error reporting dialogs or prompt box.
This technique was seen in DarkGate malware as part of its installation.

Pinned Atomic procedure · 09147b61-40f6-4b2a-b6fb-9e73a3437c96 · windows · command_prompt.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

This task recreates the steps taken by BlackByte ransomware before it worms to other machines via Powershell. See "Preparing to Worm" section: https://redcanary.com/blog/blackbyte-ransomware/
The steps are as follows:
<ol>
<li>1. Elevate Local Privilege by disabling UAC Remote Restrictions</li>
<li>2. Enable OS to share network connections between different privilege levels</li>
<li>3. Enable long path values for file paths, names, and namespaces to ensure encryption of all file names and paths</li>
</ol>
The registry keys and their respective values will be created upon successful execution.

Pinned Atomic procedure · 0b79c06f-c788-44a2-8630-d69051f1123d · windows · powershell.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Allow startup PIN with TPM for Bitlocker tool

Pinned Atomic procedure · 10b33fb0-c58b-44cd-8599-b6da5ad6384c · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Disable Win Defender Notification. Redline is using this to disable this win defender feature.

Pinned Atomic procedure · 12e03af7-79f9-4f95-af48-d3f12f28a260 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify the registry of the currently logged in user using reg.exe via cmd console to Disable and remove the Shut Down command Group Policy.
Take note that some Group Policy changes might require a restart to take effect.
See how Trojan abuses this technique- https://www.sophos.com/de-de/threat-center/threat-analyses/viruses-and-spyware/Troj~Krotten-N/detailed-analysis

Pinned Atomic procedure · 12f50e15-dbc6-478b-a801-a746e8ba1723 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify the registry of the currently logged in user using reg.exe via cmd console. Upon execution, the message "The operation completed successfully."
will be displayed. Additionally, open Registry Editor to view the new entry in HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced.

Pinned Atomic procedure · 1324796b-d0f6-455a-b4ae-21ffee6aa6b9 · windows · command_prompt.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Upon execution, a javascript block will be placed in the registry for persistence.
Additionally, open Registry Editor to view the modified entry in HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings.

Pinned Atomic procedure · 15f44ea9-4571-4837-be9e-802431a7bfae · windows · powershell.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify the registry value of fDenyTSConnections to allow incoming RDP connections. This activity has been observed by multiple ransomware groups, including Hive ransomware. Reference

Pinned Atomic procedure · 16bdbe52-371c-4ccf-b708-79fba61f1db4 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

• remove_rdp_access_during_cleanup: Set to 1 if you want the cleanup to remove RDP access to machine (type integer; source default 0)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify the registry to allow a driver, service, to persist in Safe Mode.
see https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/ and https://blog.didierstevens.com/2007/03/26/playing-with-safe-mode/ for further details.
Adding a subkey to Minimal with the name of your service and a default value set to Service, makes that your service will be started when you boot into Safe Mode without networking. The same applies for the Network subkey.

Pinned Atomic procedure · 1dd59fb3-1cb3-4828-805d-cf80b4c3bbb5 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify the registry of the currently logged in user using reg.exe via cmd console to hide Properties from "My Documents icon" Group Policy.
Take note that some Group Policy changes might require a restart to take effect.
See how ransomware abuses this technique- https://www.virustotal.com/gui/file/2d7855bf6470aa323edf2949b54ce2a04d9e38770f1322c3d0420c2303178d91/details

Pinned Atomic procedure · 20fc9daa-bd48-4325-9aff-81b967a84b1d · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Requires the BitLocker PIN for Pre-boot authentication

Pinned Atomic procedure · 26fc7375-a551-4336-90d7-3f2817564304 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify the Local Machine registry RUN key to change Windows Defender executable that should be ran on startup. This should only be possible when
CMD is ran as Administrative rights. Upon execution, the message "The operation completed successfully."
will be displayed. Additionally, open Registry Editor to view the modified entry in HKLM\Software\Microsoft\Windows\CurrentVersion\Run.

Pinned Atomic procedure · 282f929a-6bc5-42b8-bd93-960c3ba35afe · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

• new_executable: New executable to run on startup instead of Windows Defender (type string; source default calc.exe)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Replacing the registry settings with custom executable will end up with the replacement programs being executed at the time OS will decide to kick off the respective activity

Pinned Atomic procedure · 3235aafe-b49d-451b-a1f1-d979fa65ddaf · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Windows Auto Update Option to Notify before download. Redline is using this as part of its defense evasion.

Pinned Atomic procedure · 335a6b15-b8d2-4a3f-a973-ad69aa2620d7 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

The built-in Windows Remote Desktop Connection (RDP) client (mstsc.exe) saves the remote computer name (or IP address) and the username that is used to login after each successful connection to the remote computer

Pinned Atomic procedure · 3448824b-3c35-4a9e-a8f5-f887f68bea21 · windows · command_prompt.

Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• Must have the "MR9" Remote Desktop Connection history Key

This test emulates Mimic ransomware's ability to enable multiple RDP sessions per user by modifying the fSingleSessionPerUser value within the Terminal Server registry key.
See [Mimic Ransomware Overview] (https://www.trendmicro.com/en_us/research/23/a/new-mimic-ransomware-abuses-everything-apis-for-its-encryption-p.html)

Pinned Atomic procedure · 35727d9e-7a7f-4d0c-a259-dc3906d6e8b9 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

A registry modification to allow Simultaneous download in the system.

Pinned Atomic procedure · 37950714-e923-4f92-8c7c-51e4b6fffbf6 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Disable Windows Auto Reboot for current logon user. Redline is using this as part of its defense evasion.

Pinned Atomic procedure · 396f997b-c5f8-4a96-bb2c-3c8795cf459d · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

This test emulates Mimic ransomware's ability to enable multiple user sessions by modifying the AllowMultipleTSSessions value within the Winlogon registry key.
See [Mimic Ransomware Overview] (https://www.trendmicro.com/en_us/research/23/a/new-mimic-ransomware-abuses-everything-apis-for-its-encryption-p.html)

Pinned Atomic procedure · 39f1f378-ba8a-42b3-96dc-2a6540cfc1e3 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Allow startup PIN with TPM for Bitlocker tool

Pinned Atomic procedure · 3ac0b30f-532f-43c6-8f01-fb657aaed7e4 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Tamper Win Defender Protection. RedLine Stealer is executing another component file to modify this win defender feature in registry.
Take note that this modification might not be enough to disable this feature but can be a good indicator of malicious process that
tries to tamper this Win Defender feature settings.

Pinned Atomic procedure · 3b625eaa-c10d-4635-af96-3eae7d2a2f3c · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify the registry of the currently logged in user using reg.exe via cmd console to disable the windows Lock workstation feature.
See how ransomware abuses this technique- https://www.bleepingcomputer.com/news/security/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer/

Pinned Atomic procedure · 3dacb0d2-46ee-4c27-ac1b-f9886bf91a56 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify the registry of the currently logged in user using reg.exe via cmd console to remove the networking icon Group Policy.
Take note that some Group Policy changes might require a restart to take effect.
See how ransomware abuses this technique- https://www.virustotal.com/gui/file/2d7855bf6470aa323edf2949b54ce2a04d9e38770f1322c3d0420c2303178d91/details

Pinned Atomic procedure · 3e757ce7-eca0-411a-9583-1c33b8508d52 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

The Windows Compatibility Telemetry system makes use of the CompatTelRunner.exe binary to run a variety of telemetry tasks. It relies on the registry for instructions on which commands to run.
It will run any arbitrary command without restriction of location or type. Blog :https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence

Pinned Atomic procedure · 4469192c-2d2d-4a3a-9758-1f31d937a92b · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

• new_key: New Registry Key Added (type string; source default NewKey)
• new_executable: Custom Executable to run (type string; source default C:\Windows\System32\notepad.exe)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify the registry of the currently logged in user using reg.exe via cmd console to disable the windows security center notification.
See how azorult malware abuses this technique- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/

Pinned Atomic procedure · 45914594-8df6-4ea9-b3cc-7eb9321a807e · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

A modification registry to disable RDP security settings. This technique was seen in DarkGate malware as part of its installation

Pinned Atomic procedure · 4b81bcfa-fb0a-45e9-90c2-e3efe5160140 · windows · command_prompt.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Enforce Smart Card Authentication Through Registry

Pinned Atomic procedure · 4c4bf587-fe7f-448f-ba8d-1ecec9db88be · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify the registry of the currently logged in user using reg.exe via cmd console to Disable context menu for taskbar Group Policy.
Take note that some Group Policy changes might require a restart to take effect.
See how ransomware abuses this technique- https://www.virustotal.com/gui/file/2d7855bf6470aa323edf2949b54ce2a04d9e38770f1322c3d0420c2303178d91/details

Pinned Atomic procedure · 4d72d4b1-fa7b-4374-b423-0fe326da49d2 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

This task recreates the steps taken by BlackByte ransomware before it worms to other machines. See "Preparing to Worm" section: https://redcanary.com/blog/blackbyte-ransomware/
The steps are as follows:
<ol>
<li>1. Elevate Local Privilege by disabling UAC Remote Restrictions</li>
<li>2. Enable OS to share network connections between different privilege levels</li>
<li>3. Enable long path values for file paths, names, and namespaces to ensure encryption of all file names and paths</li>
</ol>
The registry keys and their respective values will be created upon successful execution.

Pinned Atomic procedure · 4f4e2f9f-6209-4fcf-9b15-3b7455706f5b · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

As per Microsoft,the entries found under App Paths are used primarily to map an application’s executable file name to that file’s fully qualified path and to pre-pend information to the PATH environment variable on a per-application, per-process basis.
The path can be modified to load a custom application of choice.
Post the registry changes of this test, when someone tries to manually run msedge.exe via StartMenu/Run window , notepad will be launched.

Pinned Atomic procedure · 573d15da-c34e-4c59-a7d2-18f20d92dfa3 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

• app_name: path of application to be modified (type string; source default msedge.exe)
• new_path: New App Path Added (type string; source default C:\Windows\System32\notepad.exe)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Replacing the registry settings with custom executable will end up with the replacement programs being executed at the time OS will decide to kick off the respective activity

Pinned Atomic procedure · 599f3b5c-0323-44ed-bb63-4551623bf675 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify the registry of the currently logged in user using reg.exe via cmd console to Remove File menu from Windows Explorer Group Policy.
Take note that some Group Policy changes might require a restart to take effect.
See how Trojan abuses this technique- https://www.sophos.com/de-de/threat-center/threat-analyses/viruses-and-spyware/Troj~Krotten-N/detailed-analysis

Pinned Atomic procedure · 5e27bdb4-7fd9-455d-a2b5-4b4b22c9dea4 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify the registry of the machine to disable remote desktop protocol.

Pinned Atomic procedure · 5f8e36de-37ca-455e-b054-a2584f043c06 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify event viewer registry values to alter the behavior of the online help redirection. Upon opening an event in event viewer and attempting to view the help page for the event, it will open the URL or execute the program defined in the redirection URL registry entry.

Pinned Atomic procedure · 6174be7f-5153-4afd-92c5-e0c3b7cdb5ae · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

• redirection_url: URL to open or file URI to execute upon opening the event help (type url; source default file://C:\windows\system32\notepad.exe)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

A modification registry to disable RDP anti-alias settings. This technique was seen in DarkGate malware as part of its installation

Pinned Atomic procedure · 61d35188-f113-4334-8245-8c6556d43909 · windows · command_prompt.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

NetWire continues to create its home key (HKCU\SOFTWARE\NetWire) as well as adding it into the auto-run group in the victim’s registry.
See how NetWire malware - https://app.any.run/tasks/41ecdbde-4997-4301-a350-0270448b4c8f/

Pinned Atomic procedure · 65704cd4-6e36-4b90-b6c1-dc29a82c8e56 · windows · command_prompt.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Sets registry key using Powershell that will tell windows to store plaintext passwords (making the system vulnerable to clear text / cleartext password dumping).
Open Registry Editor to view the modified entry in HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest.

Pinned Atomic procedure · 68254a85-aa42-4312-a695-38b7276307f8 · windows · powershell.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify the registry of the currently logged in user using reg.exe via cmd console to disable the windows shutdown button.
See how ransomware abuses this technique- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.msil.screenlocker.a/

Pinned Atomic procedure · 6e0d1131-2d7e-4905-8ca5-d6172f05d03d · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify the registry of the currently logged in user using reg.exe via cmd console to prevent user running specific computer programs that could aid them in manually removing malware or detecting it
using security product.

Pinned Atomic procedure · 71db768a-5a9c-4047-b5e7-59e01f188e84 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify the registry of the currently logged in user using reg.exe via cmd console to show compress color and show tips feature.
See how hermeticwiper uses this technique - https://www.splunk.com/en_us/blog/security/detecting-hermeticwiper.html

Pinned Atomic procedure · 795d3248-0394-4d4d-8e86-4e8df2a2693f · windows · command_prompt.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify the registry of the machine to disable prefetch. Disabling prefetch will remove one artifact for evidence of application execution. Restart is required post modification

Pinned Atomic procedure · 7979dd41-2045-48b2-a54e-b1bc2415c9da · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Use Trusted Platform Module (TPM) for Bitlocker tool

Pinned Atomic procedure · 7c8c7bd8-0a5c-4514-a6a3-0814c5a98cf0 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

A modification registry to override RDP Authentication Level. This technique was seen in DarkGate malware as part of its installation.

Pinned Atomic procedure · 7e7b62e9-5f83-477d-8935-48600f38a3c6 · windows · command_prompt.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify the registry of the currently logged in user using reg.exe via cmd console to remove the volume icon Group Policy.
Take note that some Group Policy changes might require a restart to take effect..
See how ransomware abuses this technique- https://www.virustotal.com/gui/file/2d7855bf6470aa323edf2949b54ce2a04d9e38770f1322c3d0420c2303178d91/details

Pinned Atomic procedure · 7f037590-b4c6-4f13-b3cc-e424c5ab8ade · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify the registry of the currently logged in user using reg.exe via cmd console to Hide Clock Group Policy.
Take note that some Group Policy changes might require a restart to take effect.
See how ransomware abuses this technique- https://www.virustotal.com/gui/file/2d7855bf6470aa323edf2949b54ce2a04d9e38770f1322c3d0420c2303178d91/details

Pinned Atomic procedure · 8023db1e-ad06-4966-934b-b6a0ae52689e · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify event viewer registry values to alter the behavior of the online help redirection. Upon opening an event in event viewer and attempting to view the help page for the event, it will execute the program defined in the redirection program registry entry.

Pinned Atomic procedure · 81483501-b8a5-4225-8b32-52128e2f69db · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

• redirection_program: Path of the program to execute upon opening the event help (type path; source default C:\windows\system32\notepad.exe)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

The following Atomic Test creates a registry blob in HKLM:\SOFTWARE\Classes\.wav\OpenWithProgIds, which is related to Snake Malware. Per the report, upon execution, Snake's WerFault.exe will attempt to decrypt an encrypted blob within the Windows
registry that is typically found at HKLM:\SOFTWARE\Classes\.wav\OpenWithProgIds. The encrypted data includes the AES key, IV, and path that is used to find and decrypt the file containing Snake's kernel driver and kernel driver loader.

Pinned Atomic procedure · 8318ad20-0488-4a64-98f4-72525a012f6b · windows · powershell.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify the registry of the currently logged in user using reg.exe via cmd console to allow rdp remote assistance feature. This feature allow specific
user to rdp connect on the targeted machine.
See how azorult malware abuses this technique- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/

Pinned Atomic procedure · 86677d0e-0b5e-4a2b-b302-454175f9aa9e · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify the registry of the currently logged in user using reg.exe via cmd console to remove the battery icon Group Policy.
Take note that some Group Policy changes might require a restart to take effect.
See how ransomware abuses this technique- https://www.virustotal.com/gui/file/2d7855bf6470aa323edf2949b54ce2a04d9e38770f1322c3d0420c2303178d91/details

Pinned Atomic procedure · 8d85a5d8-702f-436f-bc78-fcd9119496fc · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify the registry of the currently logged in user using reg.exe via cmd console to hide all icons on Desktop Group Policy.
Take note that some Group Policy changes might require a restart to take effect.
See how Trojan abuses this technique- https://www.sophos.com/de-de/threat-center/threat-analyses/viruses-and-spyware/Troj~Krotten-N/detailed-analysis

Pinned Atomic procedure · 93386d41-525c-4a1b-8235-134a628dee17 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify the registry of the currently logged in user using reg.exe via cmd console to disable Powershell Module Logging, Script Block Logging, Transcription and Script Execution
see https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.PowerShell::EnableModuleLogging

Pinned Atomic procedure · 95b25212-91a7-42ff-9613-124aca6845a8 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify the registry of the currently logged in user using reg.exe via cmd console to Disable Control Panel Group Policy.
Take note that some Group Policy changes might require a restart to take effect.
See how Trojan abuses this technique- https://www.sophos.com/de-de/threat-center/threat-analyses/viruses-and-spyware/Troj~Krotten-N/detailed-analysis

Pinned Atomic procedure · a450e469-ba54-4de1-9deb-9023a6111690 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify the registry of the currently logged in user using reg.exe via cmd console to remove security and maintenance icon Group Policy.
Take note that some Group Policy changes might require a restart to take effect.
See how ransomware abuses this technique- https://www.virustotal.com/gui/file/2d7855bf6470aa323edf2949b54ce2a04d9e38770f1322c3d0420c2303178d91/details

Pinned Atomic procedure · a4637291-40b1-4a96-8c82-b28f1d73e54e · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify the registry of the currently logged in user using reg.exe via cmd console to disable the windows registry tool to prevent user modifying registry entry.
See example how Agent Tesla malware abuses this technique: https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry

Pinned Atomic procedure · ac34b0f7-0f85-4ac0-b93e-3ced2bc69bb8 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Microsoft Remote Desktop Protocol (RDP) supports a “shadowing” feature and RDP is available in all Windows Server Operating Systems and the business editions of end-user Windows versions. In order to use the RDP shadowing feature, the Remote Desktop Services (TermService) service needs to be running (which it does by default), a rule needs to be enabled in the Windows Firewall and in case of stealth reasons, a setting needs to be configured to not prompt the user for permission when they are being shadowed. In order to configure RDP shadowing session in a quiet mode. The registry of a remote system can be updated using several protocols, depending on the accessible ports and configuration of the services listening on those ports. Our aim is to set the Shadow value in HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services on the remote machine to 2, which allows us to both view and control the session without the user being informed. Reference

Pinned Atomic procedure · ac494fe5-81a4-4897-af42-e774cf005ecb · windows · powershell.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

• server_name: The remote server that we need to shadow and have to do the registry modification. (type string; source default localhost)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify the registry of the currently logged in user using reg.exe via cmd console to disable the windows task manager application.
See example how Agent Tesla malware abuses this technique: https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry

Pinned Atomic procedure · af254e70-dd0e-4de6-9afe-a994d9ea8b62 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

This test simulates an adversary modifying the Internet Zone Protocol Defaults in the registry of the currently logged-in user using PowerShell. Such modifications can be indicative of an adversary attempting to weaken browser security settings.
To verify the effects of the test:
1. Open the Registry Editor (regedit.exe).
2. Navigate to "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults".
3. Check for the presence of the "http" and "https" DWORD values set to `0`.
Or run:
```powershell
Get-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults' | Select-Object http,https
```

Pinned Atomic procedure · b1a4d687-ba52-4057-81ab-757c3dc0d3b5 · windows · powershell.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Allow startup key with TPM for Bitlocker tool

Pinned Atomic procedure · b5169fd5-85c8-4b2c-a9b6-64cc0b9febef · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Emulates the registry-storing behavior of Turla's Mosquito backdoor. Mosquito records its components in the registry key HKCU\Software\Microsoft\Windows\OneDriveUpdate
so its loader can reassemble the chain at runtime. It writes:

1. The name of the original (legitimately hijacked) DLL, tagged with the CLSID, into an
"explorer.exe" value under the OneDriveUpdate key.
2. The path to the main backdoor into the default value of the same OneDriveUpdate key.

Mosquito disguises its backdoor as an Adobe Acrobat support file (AdobeSysFnt09.pdb). This test
only writes the registry values referencing that IOC-matching file path and hijacked DLL name.

Reference: https://www.welivesecurity.com/wp-content/uploads/2018/05/ESET_Turla_Mosquito.pdf

Pinned Atomic procedure · b6a03947-452c-4137-afaa-112b3c924fd6 · windows · powershell.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• Back up any pre-existing OneDriveUpdate registry key so its original values can be restored during cleanup.

Allow BitLocker without a compatible TPM (requires a password)

Pinned Atomic procedure · bacb3e73-8161-43a9-8204-a69fe0e4b482 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Sets registry key that will tell windows to store plaintext passwords (making the system vulnerable to clear text / cleartext password dumping).
Upon execution, the message "The operation completed successfully." will be displayed.
Additionally, open Registry Editor to view the modified entry in HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest.

Pinned Atomic procedure · c0413fb5-33e2-40b7-9b6f-60b29f4a7a18 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify the registry of the currently logged in user using reg.exe via cmd console to disable the windows notification center.
See how remcos rat abuses this technique- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html

Pinned Atomic procedure · c0d6d67f-1f63-42cc-95c0-5fd6b20082ad · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify the registry to allow a driver, service, to persist in Safe Mode with networking.
see https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/ and https://blog.didierstevens.com/2007/03/26/playing-with-safe-mode/ for further details.
Adding a subkey to Netowrk with the name of your service and a default value set to Service, makes that your service will be started when you boot into Safe Mode with networking.

Pinned Atomic procedure · c173c948-65e5-499c-afbe-433722ed5bd4 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Detect the disable secondary authentication activities that adversary attempt to bypass MFA and to get the unauthorized access to the system or sensitive data.
See the related article (https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.SecondaryAuthenticationFactor::MSSecondaryAuthFactor_AllowSecondaryAuthenticationDevice).

Pinned Atomic procedure · c26fb85a-fa50-4fab-a64a-c51f5dc538d5 · windows · command_prompt.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify the registry of the currently logged in user using reg.exe via cmd console to suppress the windows defender notification.
See how azorult malware abuses this technique- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/

Pinned Atomic procedure · c30dada3-7777-4590-b970-dc890b8cf113 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Ursnif downloads additional modules from the C&C server and saves these in the registry folder HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\
More information - https://blog.trendmicro.com/trendlabs-security-intelligence/phishing-campaign-uses-hijacked-emails-to-deliver-ursnif-by-replying-to-ongoing-threads/

Pinned Atomic procedure · c375558d-7c25-45e9-bd64-7b23a97c1db0 · windows · command_prompt.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

If the fInheritInitialProgram value is set to 1, the exe indicated in the InitialProgram value is automatically started on RDP connection.
Once the test commands are run, notepad will execute automatically on new RDP connection

Pinned Atomic procedure · c691cee2-8d17-4395-b22f-00644c7f1c2d · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Allow startup key with TPM for Bitlocker tool

Pinned Atomic procedure · c8480c83-a932-446e-a919-06a1fd1e512a · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

This test simulates an adversary modifying the Internet Zone Protocol Defaults in the registry of the currently logged-in user using the reg.exe utility via the command prompt. Such modifications can be indicative of an adversary trying to weaken browser security settings. Upon execution, if successful, the message "The operation completed successfully." will be displayed.
To verify the effects of the test:
1. Open the Registry Editor (regedit.exe).
2. Navigate to "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults".
3. Check for the presence of the "http" and "https" DWORD values set to `0`.
Or run:
```batch
reg query "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults"
```

Pinned Atomic procedure · c88ef166-50fa-40d5-a80c-e2b87d4180f7 · windows · command_prompt.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Scarab Ransomware defense evasion activities that can abuse the registry values to modify the settings of the Credential Security Support Provider to overcome potential RDP connection issues. Scarab Ransomware Article

Pinned Atomic procedure · ca8ba39c-3c5a-459f-8e15-280aec65a910 · windows · command_prompt.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Attackers may add a domain to the trusted site zone to bypass defenses. Doing this enables attacks such as c2 over office365.
Upon execution, details of the new registry entries will be displayed.
Additionally, open Registry Editor to view the modified entry in HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\.

https://www.blackhat.com/docs/us-17/wednesday/us-17-Dods-Infecting-The-Enterprise-Abusing-Office365-Powershell-For-Covert-C2.pdf

Pinned Atomic procedure · cf447677-5a4e-4937-a82c-e47d254afd57 · windows · powershell.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

• bad_domain: Domain to add to trusted site zone (type string; source default bad-domain.com)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Do Not Connect To Win Update. Redline is using this as part of its defense evasion.

Pinned Atomic procedure · d1de3767-99c2-4c6c-8c5a-4ba4586474c8 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify the registry of the currently logged in user using reg.exe via cmd console to disable the windows CMD application.
See example how Agent Tesla malware abuses this technique: https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry

Pinned Atomic procedure · d2561a6d-72bd-408c-b150-13efe1801c2a · windows · powershell.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify the registry of the currently logged in user using reg.exe via cmd console to Disable changes to Taskbar and Start Menu Settings Group Policy.
Take note that some Group Policy changes might require a restart to take effect.
See how ransomware abuses this technique- https://www.virustotal.com/gui/file/2d7855bf6470aa323edf2949b54ce2a04d9e38770f1322c3d0420c2303178d91/details

Pinned Atomic procedure · d29b7faf-7355-4036-9ed3-719bd17951ed · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify the registry of the currently logged in user using reg.exe via cmd console to disable windows error reporting settings. This Windows feature allow the use to report bug, errors, failure or problems
encounter in specific application or process.
See how azorult malware abuses this technique- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/

Pinned Atomic procedure · d2c9e41e-cd86-473d-980d-b6403562e3e1 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify the registry of the currently logged in user using reg.exe via cmd console to Remove Run menu from Start Menu Group Policy.
Take note that some Group Policy changes might require a restart to take effect.
See how Trojan abuses this technique- https://www.sophos.com/de-de/threat-center/threat-analyses/viruses-and-spyware/Troj~Krotten-N/detailed-analysis

Pinned Atomic procedure · d49ff3cc-8168-4123-b5b3-f057d9abbd55 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify the registry of the currently logged in user using reg.exe via cmd console to disable the windows change password feature.
See how ransomware abuses this technique- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_heartbleed.thdobah

Pinned Atomic procedure · d4a6da40-618f-454d-9a9e-26af552aaeb0 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

A modification registry to setup proxy server. This technique was seen in DarkGate malware as part of its installation.

Pinned Atomic procedure · d88a3d3b-d016-4939-a745-03638aafd21b · windows · command_prompt.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify the registry of the currently logged in user using reg.exe via cmd console to disable the windows logoff button.
See how ransomware abuses this technique- https://www.trendmicro.com/vinfo/be/threat-encyclopedia/search/js_noclose.e/2

Pinned Atomic procedure · e246578a-c24d-46a7-9237-0213ff86fb0c · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Enabling RDP through remote registry.

Pinned Atomic procedure · e3ad8e83-3089-49ff-817f-e52f8c948090 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Allow Bitlocker without TPM for Bitlocker tool

Pinned Atomic procedure · e672a340-a933-447c-954c-d68db38a09b1 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Sets the LocalAccountTokenFilterPolicy registry value to 1 under
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System. This disables UAC
remote restrictions (token filtering) so that local administrator accounts receive
a full (non-filtered) high-integrity token when authenticating over the network,
enabling remote administrative actions such as Pass-the-Hash and remote WMI/SMB
admin access.

Pinned Atomic procedure · e8c7c404-b669-4cf9-bafd-fdad89a5bbb1 · windows · powershell.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• Save current LocalAccountTokenFilterPolicy state for cleanup restore.

A modification registry to enable proxy settings. This technique was seen in DarkGate malware as part of its installation.

Pinned Atomic procedure · eb0ba433-63e5-4a8c-a9f0-27c4192e1336 · windows · command_prompt.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

The ShimCache is a component in Windows operating systems that stores information about recently executed applications. It is used by the operating system to speed up the launching process of applications. The ShimCache is also used by IR teams and Forensic teams. Forensic investigators can use the ShimCache to determine which programs have been executed on a system, even if they have been deleted or their logs have been cleared.Reference : https://blueteamops.medium.com/shimcache-flush-89daff28d15e

Pinned Atomic procedure · ecbd533e-b45d-4239-aeff-b857c6f6d68b · windows · command_prompt.

Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Replacing the registry settings with custom executable will end up with the replacement programs being executed at the time OS will decide to kick off the respective activity

Pinned Atomic procedure · f2915249-4485-42e2-96b7-9bf34328d497 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Attackers need to change the powershell execution policy in order to run their malicious powershell scripts.
They can either specify it during the execution of the powershell script or change the registry value for it.

Pinned Atomic procedure · f3a6cceb-06c9-48e5-8df8-8867a6814245 · windows · powershell.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

• default_execution_policy: Specify the default poweshell execution policy (type string; source default Default)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Enabling Restricted Admin Mode via Command_Prompt,enables an attacker to perform a pass-the-hash attack using RDP.

See Passing the Hash with Remote Desktop

Pinned Atomic procedure · fe7974e5-5813-477b-a7bd-311d4f535e83 · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Modify the registry of the currently logged in user using reg.exe via cmd console to Remove Search menu from Start Menu Group Policy.
Take note that some Group Policy changes might require a restart to take effect.
See how Trojan abuses this technique- https://www.sophos.com/de-de/threat-center/threat-analyses/viruses-and-spyware/Troj~Krotten-N/detailed-analysis

Pinned Atomic procedure · ffbb407e-7f1d-4c95-b22e-548169db1fbd · windows · command_prompt.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Detect the Microsoft FIDO authentication disable activities that adversary attempt to gains access to login credentials (e.g., passwords), they may be able to impersonate the user and access sensitive accounts or data and also increases the risk of falling victim to phishing attacks.
See the related article (https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.FidoAuthentication::AllowFidoDeviceSignon).

Pinned Atomic procedure · ffeddced-bb9f-49c6-97f0-3d07a509bf94 · windows · command_prompt.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

• M1024 Restrict Registry Permissions

  Ensure proper permissions are set for Registry hives to prevent users from modifying keys for system components that may lead to privilege escalation.