Procedure examples

Cobalt Strike can query HKEY_CURRENT_USER\Software\Microsoft\Office\<Excel Version>\Excel\Security\AccessVBOM\ to determine if the security setting for restricting default programmatic access is enabled.

SUNBURST collected the registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid from compromised hosts.

REvil can query the Registry to get random file extensions to append to encrypted files.

Valak can use the Registry for code updates and to collect credentials.

Samurai can query `SOFTWARE\Microsoft\.NETFramework\policy\v2.0` for discovery.

Milan can query `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid` to retrieve the machine GUID.

Taidoor can query the Registry on compromised hosts using RegQueryValueExA.

Raccoon Stealer queries the Windows Registry to fingerprint the infected host via the `HKLM:\SOFTWARE\Microsoft\Cryptography\MachineGuid` key.

Carbon enumerates values in the Registry.

Cardinal RAT contains watchdog functionality that periodically ensures HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load is set to point to its executable.

Gold Dragon enumerates registry keys with the command regkeyenum and obtains information for the Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.

Carberp has searched the Image File Execution Options registry key for "Debugger" within every subkey.

Pillowmint has used shellcode which reads code stored in the registry keys \REGISTRY\SOFTWARE\Microsoft\DRM using the native Windows API as well as read HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces as part of its C2.

FunnyDream can check `Software\Microsoft\Windows\CurrentVersion\Internet Settings` to extract the `ProxyServer` string.

CHOPSTICK provides access to the Windows Registry, which can be used to gather information.

FELIXROOT queries the Registry for specific keys for potential privilege escalation and proxy information. FELIXROOT has also used WMI to query the Windows Registry.

ZxShell can query the netsvc group value data located in the svchost group Registry key.

BabyShark has executed the reg query command for HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default.

njRAT can read specific registry values.

ComRAT can check the default browser by querying HKCR\http\shell\open\command.

JPIN can enumerate Registry keys.

Qilin can check `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control SystemStartOptions` to determine if a machine is running in safe mode.

Industroyer has a data wiper component that enumerates keys in the Registry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services.

DownPaper searches and reads the value of the Windows Update Registry Run key.

Gelsemium can open random files and Registry keys to obscure malware behavior from sandbox analysis.

Denis queries the Registry for keys and values.

Waterbear can query the Registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSDTC\MTxOCI" to see if the value `OracleOcilib` exists.

OSInfo queries the registry to look for information about Terminal Services.

Dtrack can collect the RegisteredOwner, RegisteredOrganization, and InstallDate registry values.

Azorult can check for installed software on the system under the Registry key Software\Microsoft\Windows\CurrentVersion\Uninstall.

BitPaymer can use the RegEnumKeyW to iterate through Registry keys.

BACKSPACE is capable of enumerating and making modifications to an infected system's Registry.

ADVSTORESHELL can enumerate registry keys.

SILENTTRINITY can use the `GetRegValue` function to check Registry keys within `HKCU\Software\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated` and `HKLM\Software\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated`. It also contains additional modules that can check software AutoRun values and use the Win32 namespace to get values from HKCU, HKLM, HKCR, and HKCC hives.

PowerSploit contains a collection of Privesc-PowerUp modules that can query Registry keys for potential opportunities.

PcShare can search the registry files of a compromised host.

Remcos can obtain Registry data from targeted systems.

Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface.

Stuxnet uses a Windows rootkit to mask its binaries and other relevant files.

MEDUSA is a rootkit with command execution and credential logging capabilities.

COATHANGER hooks or replaces multiple legitimate processes and other functions on victim devices.

Umbreon hides from defenders by hooking libc function calls, hiding artifacts that would reveal its presence, such as the user account it creates to provide access and undermining strace, a tool often used to identify malware.

Hildegard has modified /etc/ld.so.preload to overwrite readdir() and readdir64().

Hacking Team UEFI Rootkit is a UEFI BIOS rootkit developed by the company Hacking Team to persist remote access software on some targeted systems.

Skidmap is a kernel-mode rootkit that has the ability to hook system calls to hide specific files and fake network and CPU-related statistics to make the CPU load of the infected machine always appear low.

Line Dancer can hook both the crash dump process and the Autehntication, Authorization, and Accounting (AAA) functions on compromised machines to evade forensic analysis and authentication mechanisms.

REPTILE has the ability to hook kernel functions and modify functions data to achieve rootkit functionality such as hiding processes and network connections.

Zeroaccess is a kernel-mode rootkit.

Caterpillar WebShell has a module to use a rootkit on a system.

Uroburos can use its kernel module to prevent its host components from being listed by the targeted system's OS and to mediate requests between user mode and concealed components.