T1112 Modify Registry

Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution. MITRE ATT&CK

3 programs on CmdID 24 Sigma rules T1112 on attack.mitre.org

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules

dnscmd.exeits Sigma rules reg.exeits Sigma rules regini.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first

criticalOilRig APT ActivityFlorian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community · Windows

highBlue MockingbirdTrent Liffick (@tliffick) · Windows

highEnable LM Hash Storage - ProcCreationNasreddine Bencherchali (Nextron Systems) · Windows

highImports Registry Key From an ADSOddvar Moe, Sander Wiebing, oscd.community · Windows

highNew DNS ServerLevelPluginDll Installed Via Dnscmd.EXEFlorian Roth (Nextron Systems) · Windows

highNon-privileged Usage of Reg or PowershellTeymur Kheirkhabarov (idea), Ryan Plas (rule), oscd.community · Windows

highPotential Tampering With RDP Related Registry Keys Via Reg.EXEpH-T (Nextron Systems), @Kostastsale, TheDFIRReport · Windows

highReg Add Suspicious Pathsfrack113, Nasreddine Bencherchali (Nextron Systems) · Windows

highRestrictedAdminMode Registry Value Tampering - ProcCreationfrack113 · Windows

highSecurity Event Logging Disabled via MiniNt Registry Key - ProcessSwachchhanda Shrawan Poudel (Nextron Systems) · Windows

highShimCache FlushFlorian Roth (Nextron Systems) · Windows

highSuspicious Registry Modification From ADS Via Regini.EXEEli Salem, Sander Wiebing, oscd.community · Windows

highSuspicious WSL InstallLocation Registry Key Modification Via CommandLineSwachchhanda Shrawan Poudel (Nextron Systems) · Windows

highUser Shell Folders Registry Modification via CommandLineSwachchhanda Shrawan Poudel (Nextron Systems) · Windows

mediumImports Registry Key From a FileOddvar Moe, Sander Wiebing, oscd.community · Windows

mediumPotential Suspicious Registry File Imported Via Reg.EXEfrack113, Nasreddine Bencherchali · Windows

mediumPotentially Suspicious Desktop Background Change Using Reg.EXEStephen Lincoln @slincoln-aiq (AttackIQ) · Windows

mediumRegistry Manipulation via WMI StdregprovDaniel Koifman (KoifSec) · Windows

mediumRegistry Modification Attempt Via VBScriptSwachchhanda Shrawan Poudel (Nextron Systems) · Windows

mediumRegistry Modification of MS-settings Protocol Handlerfrack113, Swachchhanda Shrawan Poudel (Nextron Systems) · Windows

mediumRegistry Tampering Of Internal Tools SettingsSwachchhanda Shrawan Poudel (Nextron Systems) · Windows

mediumSuspicious VBoxDrvInst.exe ParametersKonstantin Grishchenko, oscd.community · Windows

lowRegistry Modification Via Regini.EXEEli Salem, Sander Wiebing, oscd.community · Windows

lowRun Once Task Execution as Configured in RegistryAvneet Singh @v3t0_, oscd.community, Christopher Peacock @SecurePeacock (updated) · Windows