T1112 Modify Registry | DetectionCode

About this technique

Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.

Access to specific areas of the Registry depends on account permissions, with some keys requiring administrator-level access. The built-in Windows command-line utility Reg may be used for local or remote Registry modification. Other tools, such as remote access tools, may also contain functionality to interact with the Registry through the Windows API.

The Registry may be modified in order to hide configuration information or malicious payloads via Obfuscated Files or Information. The Registry may also be modified to impair defenses, such as by enabling macros for all Microsoft Office products, allowing privilege escalation without alerting the user, increasing the maximum number of allowed outbound requests, and/or modifying systems to store plaintext credentials in memory.

The Registry of a remote system may be modified to aid in execution of files as part of lateral movement. It requires the remote Registry service to be running on the target system. Often Valid Accounts are required, along with access to the remote system's SMB/Windows Admin Shares for RPC communication.

Finally, Registry modifications may also include actions to hide keys, such as prepending key names with a null character, which will cause an error and/or be ignored when read via Reg or other utilities using the Win32 API. Adversaries may abuse these pseudo-hidden keys to conceal payloads/commands used to maintain persistence.

Detection rules164

Rules on DetectionCode tagged with T1112.

Sigma84

Rule	Level	Log source
Registry Entries For Azorult Malware	critical	windows / registry_event
Blackbyte Ransomware Registry	high	windows / registry_set
Blue Mockingbird - Registry	high	windows / registry_set
Change the Fax Dll	high	windows / registry_set
Change User Account Associated with the FAX Service	high	windows / registry_set
DHCP Callout DLL Installation	high	windows / registry_set
Disable Security Events Logging Adding Reg Key MiniNt	high	windows / registry_event
Enable LM Hash Storage	high	windows / registry_set
Enable LM Hash Storage - ProcCreation	high	windows / process_creation
ETW Logging Disabled In .NET Processes - Registry	high	windows / NULL
ETW Logging Disabled In .NET Processes - Sysmon Registry	high	windows / registry_set
Imports Registry Key From an ADS	high	windows / process_creation
Macro Enabled In A Potentially Suspicious Document	high	windows / registry_set
NET NGenAssemblyUsageLog Registry Key Tamper	high	windows / registry_set
NetNTLM Downgrade Attack	high	windows / NULL
NetNTLM Downgrade Attack - Registry	high	windows / registry_event
New DNS ServerLevelPluginDll Installed	high	windows / registry_set
New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE	high	windows / process_creation
Non-privileged Usage of Reg or Powershell	high	windows / process_creation
Office Macros Warning Disabled	high	windows / registry_set
Outlook EnableUnsafeClientMailRules Setting Enabled - Registry	high	windows / registry_set
Potential NetWire RAT Activity - Registry	high	windows / registry_add
Potential Persistence Via Outlook Home Page	high	windows / registry_set
Potential Persistence Via Outlook Today Page	high	windows / registry_set
Potential Qakbot Registry Activity	high	windows / registry_event
Potential Tampering With RDP Related Registry Keys Via Reg.EXE	high	windows / process_creation
PowerShell Logging Disabled Via Registry Key Tampering	high	windows / registry_set
RDP Sensitive Settings Changed	high	windows / registry_set
RedMimicry Winnti Playbook Registry Manipulation	high	windows / registry_event
Reg Add Suspicious Paths	high	windows / process_creation
Registry Modification for OCI DLL Redirection	high	windows / registry_set
Remote Registry Lateral Movement	high	rpc_firewall / application
RestrictedAdminMode Registry Value Tampering	high	windows / registry_set
RestrictedAdminMode Registry Value Tampering - ProcCreation	high	windows / process_creation
Security Event Logging Disabled via MiniNt Registry Key - Process	high	windows / process_creation
Security Event Logging Disabled via MiniNt Registry Key - Registry Set	high	windows / registry_set
Service Binary in Suspicious Folder	high	windows / registry_set
ShimCache Flush	high	windows / process_creation
Suspicious Registry Modification From ADS Via Regini.EXE	high	windows / process_creation
Suspicious WSL InstallLocation Registry Key Modification Via CommandLine	high	windows / process_creation
Sysmon Channel Reference Deletion	high	windows / NULL
Terminal Server Client Connection History Cleared - Registry	high	windows / registry_delete
Trust Access Disable For VBApplications	high	windows / registry_set
Uncommon Microsoft Office Trusted Location Added	high	windows / registry_set
User Shell Folders Registry Modification via CommandLine	high	windows / process_creation
Wdigest CredGuard Registry Modification	high	windows / registry_event
Wdigest Enable UseLogonCredential	high	windows / registry_set
Windows Event Log Access Tampering Via Registry	high	windows / registry_set
Activate Suppression of Windows Security Center Notifications	medium	windows / registry_set
Add DisallowRun Execution to Registry	medium	windows / registry_set
Allow RDP Remote Assistance Feature	medium	windows / registry_set
ClickOnce Trust Prompt Tampering	medium	windows / registry_set
CrashControl CrashDump Disabled	medium	windows / registry_set
Disable Internal Tools or Feature in Registry	medium	windows / registry_set
Disable Windows Security Center Notifications	medium	windows / registry_set
DNS-over-HTTPS Enabled by Registry	medium	windows / registry_set
Imports Registry Key From a File	medium	windows / process_creation
New BgInfo.EXE Custom DB Path Registry Configuration	medium	windows / registry_set
New BgInfo.EXE Custom VBScript Registry Configuration	medium	windows / registry_set
New BgInfo.EXE Custom WMI Query Registry Configuration	medium	windows / registry_set
Potential Persistence Via Custom Protocol Handler	medium	windows / registry_set
Potential Persistence Via Event Viewer Events.asp	medium	windows / registry_set
Potential Suspicious Registry File Imported Via Reg.EXE	medium	windows / process_creation
Potential WSL InstallLocation Registry Key Modification	medium	windows / registry_set
Potentially Suspicious Desktop Background Change Using Reg.EXE	medium	windows / process_creation
Potentially Suspicious Desktop Background Change Via Registry	medium	windows / registry_set
Potentially Suspicious Image Load of Offreg.dll	medium	windows / image_load
RDP Sensitive Settings Changed to Zero	medium	windows / registry_set
Registry Explorer Policy Modification	medium	windows / registry_set
Registry Hide Function from User	medium	windows / registry_set
Registry Manipulation via WMI Stdregprov	medium	windows / process_creation
Registry Modification Attempt Via VBScript	medium	windows / process_creation
Registry Modification Attempt Via VBScript - PowerShell	medium	windows / ps_script
Registry Modification of MS-settings Protocol Handler	medium	windows / process_creation
Registry Tampering by Potentially Suspicious Processes	medium	windows / registry_event
Removal of Potential COM Hijacking Registry Keys	medium	windows / registry_delete
Run Once Task Configuration in Registry	medium	windows / registry_event
Suspicious VBoxDrvInst.exe Parameters	medium	windows / process_creation
Winlogon AllowMultipleTSSessions Enable	medium	windows / registry_set
ETW Logging Disabled For rpcrt4.dll	low	windows / registry_set
ETW Logging Disabled For SCM	low	windows / registry_set
Modification of IE Registry Settings	low	windows / registry_set
Registry Modification Via Regini.EXE	low	windows / process_creation
Run Once Task Execution as Configured in Registry	low	windows / process_creation

Splunk80

Rule	Type	Risk	Data source
Disable Registry Tool	TTP	NULL	Sysmon EventID 13
Disable Security Logs Using MiniNt Registry	TTP	NULL	Sysmon EventID 13
Disable Show Hidden Files	Anomaly	NULL	Sysmon EventID 13
Disable Windows App Hotkeys	TTP	NULL	Sysmon EventID 13
Disabling CMD Application	TTP	NULL	Sysmon EventID 13
Disabling ControlPanel	TTP	NULL	Sysmon EventID 13
Disabling NoRun Windows App	TTP	NULL	Sysmon EventID 13
Enable WDigest UseLogonCredential Registry	TTP	NULL	Sysmon EventID 13
FodHelper UAC Bypass	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Malicious InProcServer32 Modification	TTP	NULL	Sysmon EventID 12, Sysmon EventID 13
Remcos client registry install entry	TTP	NULL	Sysmon EventID 12, Sysmon EventID 13
Revil Registry Entry	TTP	NULL	Sysmon EventID 12, Sysmon EventID 13
Rundll32 Shimcache Flush	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Suspicious Reg exe Process	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Anomalous Registry Value Length in Environment Key	Anomaly	NULL	Sysmon EventID 13
Windows Defender ASR Registry Modification	Hunting	NULL	Windows Event Log Defender 5007
Windows Defender ASR Rule Disabled	TTP	NULL	Windows Event Log Defender 5007
Windows Deleted Registry By A Non Critical Process File Path	Anomaly	NULL	Sysmon EventID 1 AND Sysmon EventID 12
Windows Disable Change Password Through Registry	Anomaly	NULL	Sysmon EventID 13
Windows Disable Lock Workstation Feature Through Registry	Anomaly	NULL	Sysmon EventID 13
Windows Disable LogOff Button Through Registry	Anomaly	NULL	Sysmon EventID 13
Windows Disable Notification Center	Anomaly	NULL	Sysmon EventID 13
Windows Disable Shutdown Button Through Registry	Anomaly	NULL	Sysmon EventID 13
Windows Disable Windows Group Policy Features Through Registry	Anomaly	NULL	Sysmon EventID 13
Windows Downdate Registry Activity	Anomaly	NULL	Sysmon EventID 12, Sysmon EventID 13, Sysmon EventID 14
Windows Hide Notification Features Through Registry	Anomaly	NULL	Sysmon EventID 13
Windows Impair Defenses Disable AV AutoStart via Registry	TTP	NULL	Sysmon EventID 13
Windows InProcServer32 New Outlook Form	Anomaly	NULL	Sysmon EventID 13
Windows Modify Registry AuthenticationLevelOverride	Anomaly	NULL	Sysmon EventID 13
Windows Modify Registry Auto Minor Updates	Hunting	NULL	Sysmon EventID 13
Windows Modify Registry Auto Update Notif	Anomaly	NULL	Sysmon EventID 13
Windows Modify Registry Configure BitLocker	TTP	NULL	Sysmon EventID 13
Windows Modify Registry Default Icon Setting	Anomaly	NULL	Sysmon EventID 13
Windows Modify Registry Delete Firewall Rules	TTP	NULL	Sysmon EventID 12
Windows Modify Registry Disable RDP	Anomaly	NULL	Sysmon EventID 13
Windows Modify Registry Disable Restricted Admin	TTP	NULL	Sysmon EventID 13
Windows Modify Registry Disable Toast Notifications	Anomaly	NULL	Sysmon EventID 13
Windows Modify Registry Disable Win Defender Raw Write Notif	Anomaly	NULL	Sysmon EventID 13
Windows Modify Registry Disable WinDefender Notifications	TTP	NULL	Sysmon EventID 13
Windows Modify Registry Disable Windows Security Center Notif	Anomaly	NULL	Sysmon EventID 13
Windows Modify Registry DisableRemoteDesktopAntiAlias	TTP	NULL	Sysmon EventID 13
Windows Modify Registry DisableSecuritySettings	TTP	NULL	Sysmon EventID 13
Windows Modify Registry Disabling WER Settings	TTP	NULL	Sysmon EventID 13
Windows Modify Registry DisAllow Windows App	TTP	NULL	Sysmon EventID 13
Windows Modify Registry Do Not Connect To Win Update	Anomaly	NULL	Sysmon EventID 13
Windows Modify Registry DontShowUI	TTP	NULL	Sysmon EventID 13
Windows Modify Registry EnableLinkedConnections	TTP	NULL	Sysmon EventID 13
Windows Modify Registry LongPathsEnabled	Anomaly	NULL	Sysmon EventID 13
Windows Modify Registry MaxConnectionPerServer	Anomaly	NULL	Sysmon EventID 13
Windows Modify Registry No Auto Reboot With Logon User	Anomaly	NULL	Sysmon EventID 13
Windows Modify Registry No Auto Update	Anomaly	NULL	Sysmon EventID 13
Windows Modify Registry NoChangingWallPaper	TTP	NULL	Sysmon EventID 13
Windows Modify Registry on Smart Card Group Policy	Anomaly	NULL	Sysmon EventID 13
Windows Modify Registry ProxyEnable	Anomaly	NULL	Sysmon EventID 13
Windows Modify Registry ProxyServer	Anomaly	NULL	Sysmon EventID 13
Windows Modify Registry Qakbot Binary Data Registry	Anomaly	NULL	Sysmon EventID 1 AND Sysmon EventID 13
Windows Modify Registry Regedit Silent Reg Import	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Modify Registry Risk Behavior	Correlation	NULL
Windows Modify Registry Suppress Win Defender Notif	Anomaly	NULL	Sysmon EventID 13
Windows Modify Registry Tamper Protection	TTP	NULL	Sysmon EventID 13
Windows Modify Registry to Add or Modify Firewall Rule	Anomaly	NULL	Sysmon EventID 13, Sysmon EventID 14
Windows Modify Registry UpdateServiceUrlAlternate	Anomaly	NULL	Sysmon EventID 13
Windows Modify Registry USeWuServer	Hunting	NULL	Sysmon EventID 13
Windows Modify Registry Utilize ProgIDs	Anomaly	NULL	Sysmon EventID 13
Windows Modify Registry ValleyRAT C2 Config	TTP	NULL	Sysmon EventID 13
Windows Modify Registry ValleyRat PWN Reg Entry	TTP	NULL	Sysmon EventID 13
Windows Modify Registry With MD5 Reg Key Name	TTP	NULL	Sysmon EventID 13
Windows Modify Registry WuServer	Hunting	NULL	Sysmon EventID 13
Windows Modify Registry wuStatusServer	Hunting	NULL	Sysmon EventID 13
Windows Modify Show Compress Color And Info Tip Registry	TTP	NULL	Sysmon EventID 13
Windows New InProcServer32 Added	Hunting	NULL	Sysmon EventID 13
Windows Outlook Dialogs Disabled from Unusual Process	TTP	NULL	Sysmon EventID 13
Windows Outlook LoadMacroProviderOnBoot Persistence	TTP	NULL	Sysmon EventID 13
Windows Outlook WebView Registry Modification	Anomaly	NULL	Sysmon EventID 13
Windows Routing and Remote Access Service Registry Key Change	Anomaly	NULL	Sysmon EventID 13
Windows RunMRU Registry Key or Value Deleted	Anomaly	NULL	Sysmon EventID 12
Windows Set Network Profile Category to Private via Registry	Anomaly	NULL	Sysmon EventID 13
Windows Set Private Network Profile via Registry	Anomaly	NULL	Sysmon EventID 13
Windows Snake Malware Registry Modification wav OpenWithProgIds	TTP	NULL	Sysmon EventID 13
Windows SnappyBee Create Test Registry	TTP	NULL	Sysmon EventID 13

Groups29

Show 5 more

TA505 Threat Group-3390 Turla Volt Typhoon Wizard Spider

Software139

Show 115 more

Clop Cobalt Strike ComRAT Conficker CrackMapExec Crimson CSPY Downloader DarkComet DarkTortilla DarkWatchman DCSrv Embargo EVILNUM Exaramel for Windows Explosive FELIXROOT Ferocious Gelsemium gh0st RAT Grandoreiro GreyEnergy HermeticWiper HiddenFace HIUPAN HOPLIGHT Hydraq HyperStack InvisiMole IPsec Helper Kapeka KEYMARBLE KOCTOPUS KONNI LockBit 2.0 LockBit 3.0 LoJax Lokibot Mafalda MegaCortex metaMain Metamorfo Mori Mosquito MuddyViper Naid NanoCore Neoichor Nerex Netwalker NETWIRE NightClub njRAT NOOPLDR NPPSPY Orz Pandora PcShare PHOREAL Pillowmint PipeMon PLAINTEE PlugX PoetRAT PoisonIvy PolyglotDuke PowerShower Prestige Pysa QakBot Qilin QUADAGENT QuasarRAT RCSession Reg RegDuke Regin Remcos REvil ROKRAT Rover RTM Samurai ShadowPad Shamoon ShimRat ShrinkLocker Sibot SILENTTRINITY SLOTHFULMEDIA SMOKEDHAM SOUNDBITE StreamEx Stuxnet SUNBURST SynAck SysUpdate Taidoor TajMahal Tarrask TEARDROP ThreatNeedle TinyTurla TRANSLATEXT TrickBot TYPEFRAME Uroburos Ursnif Valak Volgmer WarzoneRAT WastedLocker Waterbear Zeus Panda zwShell ZxShell

Campaigns5

2015 Ukraine Electric Power Attack Night Dragon Operation Honeybee Operation Wocao SharePoint ToolShell Exploitation

Procedure examples173

Groups29

Used by	Procedure example
GroupAPT19	APT19 uses a Port 22 malware variant to modify several Registry keys. Unit 42 C0d0so0 Jan 2016
GroupAPT32	APT32's backdoor has modified the Windows Registry to store the backdoor's configuration. ESET OceanLotus Mar 2019
GroupAPT38	APT38 uses a tool called CLEANTOAD that has the capability to modify Registry keys. FireEye APT38 Oct 2018
GroupAPT41	APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials. FireEye APT41 Aug 2019 Group IB APT 41 June 2021
GroupAPT42	APT42 has modified Registry keys to maintain persistence. Mandiant APT42-charms
GroupAquatic Panda	Aquatic Panda modified the victim registry to enable the `RestrictedAdmin` mode feature, allowing for pass the hash behaviors to function via RDP. Crowdstrike HuntReport 2022
GroupBlackByte	BlackByte performed Registry modifications to escalate privileges and disable security tools. Cisco BlackByte 2024 Picus BlackByte 2022
GroupBlue Mockingbird	Blue Mockingbird has used Windows Registry modifications to specify a DLL payload. RedCanary Mockingbird May 2020

View all 29 groups examples

Software139

Used by	Procedure example
ToolAADInternals	AADInternals can modify registry keys as part of setting a new pass-through authentication agent. AADInternals Documentation
MalwareADVSTORESHELL	ADVSTORESHELL is capable of setting and deleting Registry values. Bitdefender APT28 Dec 2015
MalwareAgent Tesla	Agent Tesla can achieve persistence by modifying Registry key entries. SentinelLabs Agent Tesla Aug 2020
MalwareAmadey	Amadey has overwritten registry keys for persistence. BlackBerry Amadey 2020
MalwareAttor	Attor's dispatcher can modify the Run registry key. ESET Attor Oct 2019
MalwareAvaddon	Avaddon modifies several registry keys for persistence and UAC bypass. Arxiv Avaddon Feb 2021
MalwareBACKSPACE	BACKSPACE is capable of deleting Registry keys, sub-keys, and values on a victim system. FireEye APT30
MalwareBADCALL	BADCALL modifies the firewall Registry key `SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfileGloballyOpenPorts\\List`. US-CERT BADCALL

View all 139 software examples

Campaigns5

Used by	Procedure example
Campaign2015 Ukraine Electric Power Attack	During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching `rundll32.exe`, which in-turn launches the malware and communicates with C2 servers over the Internet. . Booz Allen Hamilton
CampaignNight Dragon	During Night Dragon, threat actors used zwShell to establish full remote control of the connected machine and manipulate the Registry. McAfee Night Dragon
CampaignOperation Honeybee	During Operation Honeybee, the threat actors used batch files that modified registry keys. McAfee Honeybee
CampaignOperation Wocao	During Operation Wocao, the threat actors enabled Wdigest by changing the `HKLM\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\WDigest` registry value from 0 (disabled) to 1 (enabled). FoxIT Wocao December 2019
CampaignSharePoint ToolShell Exploitation	During SharePoint ToolShell Exploitation, threat actors, including Storm-2603, disabled security services via Registry modifications. Microsoft SharePoint Exploit JUL 2025

References10

Avaddon Ransomware 2021 Open source
Javier Yuste and Sergio Pastrana. (2021). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved March 24, 2025.
CISA LockBit 2023 Open source
CISA. (2023, March 16). #StopRansomware: LockBit 3.0. Retrieved March 24, 2025.
CISA Russian Gov Critical Infra 2018 Open source
CISA. (2018, March 16). Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved March 24, 2025.
Microsoft BlackCat Jun 2022 Open source
Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.
Microsoft Reg Open source
Microsoft. (2012, April 17). Reg. Retrieved May 1, 2015.
Microsoft Reghide NOV 2006 Open source
Russinovich, M. & Sharkey, K. (2006, January 10). Reghide. Retrieved August 9, 2018.
Microsoft Remote Open source
Microsoft. (n.d.). Enable the Remote Registry Service. Retrieved May 1, 2015.
SpectorOps Hiding Reg Jul 2017 Open source
Reitz, B. (2017, July 14). Hiding Registry keys with PSReflect. Retrieved August 9, 2018.
TrendMicro POWELIKS AUG 2014 Open source
Santos, R. (2014, August 1). POWELIKS: Malware Hides In Windows Registry. Retrieved August 9, 2018.
Unit42 BabyShark Feb 2019 Open source
Unit 42. (2019, February 22). New BabyShark Malware Targets U.S. National Security Think Tanks. Retrieved October 7, 2019.