T1112 Modify Registry
Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution. Access to specific areas of the Registry depends on account permissions, with some keys requiring administrator-level access. The built-in Windows command-line utility [Reg](https://attack.mitre.org/software/S0075) may be used for local or remote…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- FlowCloud Registry Markerscriticaltest · windows
- OceanLotus Registry Activitycriticaltest · windows
- OilRig APT Activitycriticaltest · windows
- OilRig APT Registry Persistencecriticaltest · windows
- OilRig APT Schedule Task Persistence - Securitycriticaltest · windows
- OilRig APT Schedule Task Persistence - Systemcriticaltest · windows
- Registry Entries For Azorult Malwarecriticaltest · windows
- ShimCache Flushhighstable · windows
- Blackbyte Ransomware Registryhightest · windows
- Blue Mockingbirdhightest · windows
- Blue Mockingbird - Registryhightest · windows
- CVE-2020-1048 Exploitation Attempt - Suspicious New Printer Ports - Registryhightest · windows
- Change User Account Associated with the FAX Servicehightest · windows
- Change the Fax Dllhightest · windows
- DHCP Callout DLL Installationhightest · windows
- Disable Security Events Logging Adding Reg Key MiniNthightest · windows
- ETW Logging Disabled In .NET Processes - Registryhightest · windows
- ETW Logging Disabled In .NET Processes - Sysmon Registryhightest · windows
- Enable LM Hash Storagehightest · windows
- Enable LM Hash Storage - ProcCreationhightest · windows
- Imports Registry Key From an ADShightest · windows
- Macro Enabled In A Potentially Suspicious Documenthightest · windows
- NET NGenAssemblyUsageLog Registry Key Tamperhightest · windows
- NetNTLM Downgrade Attackhightest · windows
- NetNTLM Downgrade Attack - Registryhightest · windows
Showing 25 of 40.
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.