{"id":"T1112","name":"Modify Registry","url":"https://attack.mitre.org/techniques/T1112","tactics":["defense-impairment","persistence"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0280","stix_id":"x-mitre-detection-strategy--cf6a38ec-4c16-4c7f-8730-6e04f6dd6e67","name":"Behavior-Based Registry Modification Detection on Windows","url":"https://attack.mitre.org/detectionstrategies/DET0280","analytics":[{"id":"AN0781","stix_id":"x-mitre-analytic--de8d67d4-9d2a-4379-be8b-3ae3f3b3ac75","name":"Analytic 0781","description":"Behavior chain involving abnormal registry modifications via CLI, PowerShell, WMI, or direct API calls, especially targeting persistence, privilege escalation, or defense evasion keys, potentially followed by service restart or process execution. Such as editing Notify/Userinit/Startup keys, or disabling SafeDllSearchMode.","url":"https://attack.mitre.org/detectionstrategies/DET0280#AN0781","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"RegistryKeyPathPatterns","description":"Environment-specific list of monitored or critical registry keys, e.g., Run, Services, Security Settings, LSASS"},{"field":"ParentProcessAllowList","description":"Allowlist of legitimate registry tools (e.g., regedit.exe, msiexec.exe); used to filter known safe writes"},{"field":"TimeWindow","description":"Correlate registry change with nearby process/service execution within a defined timeframe"},{"field":"SignatureCheck","description":"Flag unsigned executables or abnormal parent-child lineage performing registry modification"}],"live":true,"detection_strategies":["DET0280"],"techniques":["T1112"]}],"live":true,"version":"1.0","techniques":["T1112"]}],"sigma_rules":[{"id":"04b45a8a-d11d-49e4-9acc-4a1b524407a5","title":"DNS-over-HTTPS Enabled by Registry","author":"Austin Songer","status":"test","level":"medium","date":"2021-07-22","modified":"2023-08-17","description":"Detects when a user enables DNS-over-HTTPS.\nThis can be used to hide internet activity or be used to hide the process of exfiltrating data.\nWith this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors.\n","references":["https://www.tenforums.com/tutorials/151318-how-enable-disable-dns-over-https-doh-microsoft-edge.html","https://github.com/elastic/detection-rules/issues/1371","https://chromeenterprise.google/policies/?policy=DnsOverHttpsMode","https://admx.help/HKLM/Software/Policies/Mozilla/Firefox/DNSOverHTTPS"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.stealth","attack.defense-impairment","attack.t1140","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_dns_over_https_enabled.yml","techniques":["T1140","T1112"],"cves":[]},{"id":"07bdd2f5-9c58-4f38-aec8-e101bb79ef8d","title":"Terminal Server Client Connection History Cleared - Registry","author":"Christian Burkard (Nextron Systems)","status":"test","level":"high","date":"2021-10-19","modified":"2023-02-08","description":"Detects the deletion of registry keys containing the MSTSC connection history","references":["https://learn.microsoft.com/en-us/troubleshoot/windows-server/remote/remove-entries-from-remote-desktop-connection-computer","http://woshub.com/how-to-clear-rdp-connections-history/","https://www.trendmicro.com/en_us/research/23/a/vice-society-ransomware-group-targets-manufacturing-companies.html"],"logsource":{"product":"windows","category":"registry_delete"},"tags":["attack.persistence","attack.stealth","attack.defense-impairment","attack.t1070","attack.t1112"],"path":"rules/windows/registry/registry_delete/registry_delete_mstsc_history_cleared.yml","techniques":["T1070","T1112"],"cves":[]},{"id":"0b80ade5-6997-4b1d-99a1-71701778ea61","title":"Imports Registry Key From an ADS","author":"Oddvar Moe, Sander Wiebing, oscd.community","status":"test","level":"high","date":"2020-10-12","modified":"2024-03-13","description":"Detects the import of a alternate datastream to the registry with regedit.exe.","references":["https://lolbas-project.github.io/lolbas/Binaries/Regedit/","https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/process_creation/proc_creation_win_regedit_import_keys_ads.yml","techniques":["T1112"],"cves":[]},{"id":"0c93308a-3f1b-40a9-b649-57ea1a1c1d63","title":"Activate Suppression of Windows Security Center Notifications","author":"frack113","status":"test","level":"medium","date":"2022-08-19","modified":"2023-08-17","description":"Detect set Notification_Suppress to 1 to disable the Windows security center notification","references":["https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1112/T1112.md"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_suppress_defender_notifications.yml","techniques":["T1112"],"cves":[]},{"id":"0d5675be-bc88-4172-86d3-1e96a4476536","title":"Potential Tampering With RDP Related Registry Keys Via Reg.EXE","author":"pH-T (Nextron Systems), @Kostastsale, TheDFIRReport","status":"test","level":"high","date":"2022-02-12","modified":"2025-11-22","description":"Detects the execution of \"reg.exe\" for enabling/disabling the RDP service on the host by tampering with the 'CurrentControlSet\\Control\\Terminal Server' values","references":["https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/","http://etutorials.org/Microsoft+Products/microsoft+windows+server+2003+terminal+services/Chapter+6+Registry/Registry+Keys+for+Terminal+Services/","http://woshub.com/rds-shadow-how-to-connect-to-a-user-session-in-windows-server-2012-r2/","https://admx.help/HKLM/SOFTWARE/Policies/Microsoft/Windows%20NT/Terminal%20Services","https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/","https://blog.sekoia.io/darkgate-internals/","https://blog.talosintelligence.com/understanding-the-phobos-affiliate-structure/","https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-63---disable-remote-desktop-anti-alias-setting-through-registry","https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-64---disable-remote-desktop-security-settings-through-registry","https://github.com/redcanaryco/atomic-red-team/blob/dd526047b8c399c312fee47d1e6fb531164da54d/atomics/T1112/T1112.yaml#L790","https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-terminalservices-rdp-winstationextensions-securitylayer","https://threathunterplaybook.com/hunts/windows/190407-RegModEnableRDPConnections/notebook.html","https://twitter.com/SagieSec/status/1469001618863624194?t=HRf0eA0W1YYzkTSHb-Ky1A&s=03","https://web.archive.org/web/20200929062532/https://blog.menasec.net/2019/02/threat-hunting-rdp-hijacking-via.html","https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.lateral-movement","attack.defense-impairment","attack.t1021.001","attack.t1112"],"path":"rules/windows/process_creation/proc_creation_win_reg_rdp_keys_tamper.yml","techniques":["T1021.001","T1112"],"cves":[]},{"id":"16a4c7b3-4681-49d0-8d58-3e9b796dcb43","title":"Potential Raspberry Robin Registry Set Internet Settings ZoneMap","author":"Swachchhanda Shrawan Poudel","status":"test","level":"low","date":"2024-07-31","modified":null,"description":"Detects registry modifications related to the proxy configuration of the system, potentially associated with the Raspberry Robin malware, as seen in campaigns running in Q1 2024.\nRaspberry Robin may alter proxy settings to circumvent security measures, ensuring unhindered connection with Command and Control servers for maintaining control over compromised systems if there are any proxy settings that are blocking connections.\n","references":["https://tria.ge/240225-jlylpafb24/behavioral1/analog?main_event=Registry&op=SetValueKeyInt","https://tria.ge/240307-1hlldsfe7t/behavioral2/analog?main_event=Registry&op=SetValueKeyInt","https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::IZ_ProxyByPass","https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::IZ_UNCAsIntranet","https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::IZ_IncludeUnspecifiedLocalSites","https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::SecurityPage_AutoDetect","https://bazaar.abuse.ch/browse/signature/RaspberryRobin/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112","detection.emerging-threats"],"path":"rules-emerging-threats/2024/Malware/Raspberry-Robin/registry_set_malware_raspberry_robin_internet_settings_zonemap_tamper.yml","techniques":["T1112"],"cves":[]},{"id":"18beca67-ab3e-4ee3-ba7a-a46ca8d7d0cc","title":"Sysmon Channel Reference Deletion","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"high","date":"2020-07-14","modified":"2025-10-22","description":"Potential threat actor tampering with Sysmon manifest and eventually disabling it","references":["https://twitter.com/Flangvik/status/1283054508084473861","https://twitter.com/SecurityJosh/status/1283027365770276866","https://securityjosh.github.io/2020/04/23/Mute-Sysmon.html","https://gist.github.com/Cyb3rWard0g/cf08c38c61f7e46e8404b38201ca01c8"],"logsource":{"product":"windows","service":"security"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/builtin/security/win_security_sysmon_channel_reference_deletion.yml","techniques":["T1112"],"cves":[]},{"id":"198effb6-6c98-4d0c-9ea3-451fa143c45c","title":"Run Once Task Execution as Configured in Registry","author":"Avneet Singh @v3t0_, oscd.community, Christopher Peacock @SecurePeacock (updated)","status":"test","level":"low","date":"2020-10-18","modified":"2022-12-13","description":"This rule detects the execution of Run Once task as configured in the registry","references":["https://twitter.com/pabraeken/status/990717080805789697","https://lolbas-project.github.io/lolbas/Binaries/Runonce/","https://twitter.com/0gtweet/status/1602644163824156672?s=20&t=kuxbUnZPltpvFPZdCrqPXA"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/process_creation/proc_creation_win_runonce_execution.yml","techniques":["T1112"],"cves":[]},{"id":"1a2d6c47-75b0-45bd-b133-2c0be75349fd","title":"Wdigest CredGuard Registry Modification","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"high","date":"2019-08-25","modified":"2021-11-27","description":"Detects potential malicious modification of the property value of IsCredGuardEnabled from\nHKLM:\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\WDigest to disable Cred Guard on a system.\nThis is usually used with UseLogonCredential to manipulate the caching credentials.\n","references":["https://teamhydra.blog/2020/08/25/bypassing-credential-guard/"],"logsource":{"product":"windows","category":"registry_event"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/registry/registry_event/registry_event_disable_wdigest_credential_guard.yml","techniques":["T1112"],"cves":[]},{"id":"1a4bd6af-99ac-4466-b5b2-7b72b4a05462","title":"Security Event Logging Disabled via MiniNt Registry Key - Process","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-04-09","modified":null,"description":"Detects attempts to disable security event logging by adding the `MiniNt` registry key.\nThis key is used to disable the Windows Event Log service, which collects and stores event logs from the operating system and applications.\nAdversaries may want to disable this service to prevent logging of security events that could be used to detect their activities.\n","references":["https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.defense-impairment","attack.t1685.001","attack.t1112","car.2022-03-001"],"path":"rules/windows/process_creation/proc_creation_win_event_logging_disable_via_key_minint.yml","techniques":["T1685.001","T1112"],"cves":[]},{"id":"1a5c46e9-f32f-42f7-b2bc-6e9084db7fbf","title":"Trust Access Disable For VBApplications","author":"Trent Liffick (@tliffick), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2020-05-22","modified":"2023-08-17","description":"Detects registry changes to Microsoft Office \"AccessVBOM\" to a value of \"1\" which disables trust access for VBA on the victim machine and lets attackers execute malicious macros without any Microsoft Office warnings.","references":["https://twitter.com/inversecos/status/1494174785621819397","https://www.mcafee.com/blogs/other-blogs/mcafee-labs/zloader-with-a-new-infection-technique/","https://securelist.com/scarcruft-surveilling-north-korean-defectors-and-human-rights-activists/105074/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_office_access_vbom_tamper.yml","techniques":["T1112"],"cves":[]},{"id":"1c3121ed-041b-4d97-a075-07f54f20fb4a","title":"Registry Explorer Policy Modification","author":"frack113","status":"test","level":"medium","date":"2022-03-18","modified":"2023-08-17","description":"Detects registry modifications that disable internal tools or functions in explorer (malware like Agent Tesla uses this technique)","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_set_nopolicies_user.yml","techniques":["T1112"],"cves":[]},{"id":"1c8e96cd-2bed-487d-9de0-b46c90cade56","title":"Potential Qakbot Registry Activity","author":"Hieu Tran","status":"test","level":"high","date":"2023-03-13","modified":null,"description":"Detects a registry key used by IceID in a campaign that distributes malicious OneNote files","references":["https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution"],"logsource":{"product":"windows","category":"registry_event"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/registry/registry_event/registry_event_malware_qakbot_registry.yml","techniques":["T1112"],"cves":[]},{"id":"1d218616-71b0-4c40-855b-9dbe75510f7f","title":"Potential NetWire RAT Activity - Registry","author":"Christopher Peacock","status":"test","level":"high","date":"2021-10-07","modified":"2025-11-03","description":"Detects registry keys related to NetWire RAT","references":["https://www.fortinet.com/blog/threat-research/new-netwire-rat-variant-spread-by-phishing","https://resources.infosecinstitute.com/topic/netwire-malware-what-it-is-how-it-works-and-how-to-prevent-it-malware-spotlight/","https://unit42.paloaltonetworks.com/guloader-installing-netwire-rat/","https://blogs.blackberry.com/en/2021/09/threat-thursday-netwire-rat-is-coming-down-the-line","https://app.any.run/tasks/41ecdbde-4997-4301-a350-0270448b4c8f/"],"logsource":{"product":"windows","category":"registry_add"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Malware/Netwire/registry_add_malware_netwire.yml","techniques":["T1112"],"cves":[]},{"id":"21f17060-b282-4249-ade0-589ea3591558","title":"Potential Ursnif Malware Activity - Registry","author":"megan201296","status":"test","level":"high","date":"2019-02-13","modified":"2025-10-22","description":"Detects registry keys related to Ursnif malware.","references":["https://blog.yoroi.company/research/ursnif-long-live-the-steganography/","https://blog.trendmicro.com/trendlabs-security-intelligence/phishing-campaign-uses-hijacked-emails-to-deliver-ursnif-by-replying-to-ongoing-threads/"],"logsource":{"product":"windows","category":"registry_add"},"tags":["attack.persistence","attack.execution","attack.defense-impairment","attack.t1112","detection.emerging-threats"],"path":"rules-emerging-threats/2019/Malware/Ursnif/registry_add_malware_ursnif.yml","techniques":["T1112"],"cves":[]},{"id":"275641a5-a492-45e2-a817-7c81e9d9d3e9","title":"Add DisallowRun Execution to Registry","author":"frack113","status":"test","level":"medium","date":"2022-08-19","modified":"2023-08-17","description":"Detect set DisallowRun to 1 to prevent user running specific computer program","references":["https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1112/T1112.md"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_disallowrun_execution.yml","techniques":["T1112"],"cves":[]},{"id":"277dc340-0540-42e7-8efb-5ff460045e07","title":"Service Binary in User Controlled Folder","author":"Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2022-05-02","modified":"2024-03-25","description":"Detects the setting of the \"ImagePath\" value of a service registry key to a path controlled by a non-administrator user such as \"\\AppData\\\" or \"\\ProgramData\\\".\nAttackers often use such directories for staging purposes.\nThis rule might also trigger on badly written software, where if an attacker controls an auto starting service, they might achieve persistence or privilege escalation.\nNote that while ProgramData is a user controlled folder, software might apply strict ACLs which makes them only accessible to admin users. Remove such folders via filters if you experience a lot of noise.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112","detection.threat-hunting"],"path":"rules-threat-hunting/windows/registry/registry_set/registry_set_service_image_path_user_controlled_folder.yml","techniques":["T1112"],"cves":[]},{"id":"28036918-04d3-423d-91c0-55ecf99fb892","title":"NET NGenAssemblyUsageLog Registry Key Tamper","author":"frack113","status":"test","level":"high","date":"2022-11-18","modified":"2023-08-17","description":"Detects changes to the NGenAssemblyUsageLog registry key.\n.NET Usage Log output location can be controlled by setting the NGenAssemblyUsageLog CLR configuration knob in the Registry or by configuring an environment variable (as described in the next section).\nBy simplify specifying an arbitrary value (e.g. fake output location or junk data) for the expected value, a Usage Log file for the .NET execution context will not be created.\n","references":["https://bohops.com/2021/03/16/investigating-net-clr-usage-log-tampering-techniques-for-edr-evasion/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_net_cli_ngenassemblyusagelog.yml","techniques":["T1112"],"cves":[]},{"id":"28ac00d6-22d9-4a3c-927f-bbd770104573","title":"RestrictedAdminMode Registry Value Tampering - ProcCreation","author":"frack113","status":"test","level":"high","date":"2023-01-13","modified":"2025-08-28","description":"Detects changes to the \"DisableRestrictedAdmin\" registry value in order to disable or enable RestrictedAdmin mode.\nRestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.\nThis prevents your credentials from being harvested during the initial connection process if the remote server has been compromise\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/a8e3cf63e97b973a25903d3df9fd55da6252e564/atomics/T1112/T1112.md","https://social.technet.microsoft.com/wiki/contents/articles/32905.remote-desktop-services-enable-restricted-admin-mode.aspx","https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/process_creation/proc_creation_win_reg_lsa_disable_restricted_admin.yml","techniques":["T1112"],"cves":[]},{"id":"2a0a169d-cc66-43ce-9ae2-6e678e54e46a","title":"Registry Modification Attempt Via VBScript - PowerShell","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-08-13","modified":null,"description":"Detects attempts to modify the registry using VBScript's CreateObject(\"Wscript.shell\") and RegWrite methods embedded within PowerShell scripts or commands.\nThreat actors commonly embed VBScript code within PowerShell to perform registry modifications, attempting to evade detection that monitors for direct registry access through traditional tools.\nThis technique can be used for persistence, defense evasion, and privilege escalation by modifying registry keys without using regedit.exe, reg.exe, or PowerShell's native registry cmdlets.\n","references":["https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/","https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/","https://detect.fyi/hunting-fileless-malware-in-the-windows-registry-1339ccde00ad"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.persistence","attack.execution","attack.defense-impairment","attack.t1112","attack.t1059.005"],"path":"rules/windows/powershell/powershell_script/posh_ps_vbscript_registry_modification.yml","techniques":["T1112","T1059.005"],"cves":[]},{"id":"2ff692c2-4594-41ec-8fcb-46587de769e0","title":"CrashControl CrashDump Disabled","author":"Tobias Michalski (Nextron Systems)","status":"test","level":"medium","date":"2022-02-24","modified":"2023-08-17","description":"Detects disabling the CrashDump per registry (as used by HermeticWiper)","references":["https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.stealth","attack.defense-impairment","attack.t1564","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_crashdump_disabled.yml","techniques":["T1564","T1112"],"cves":[]},{"id":"337a31c6-46c4-46be-886a-260d7aa78cac","title":"Access To .Reg/.Hive Files By Uncommon Applications","author":"frack113","status":"test","level":"low","date":"2023-09-15","modified":"2024-07-29","description":"Detects file access requests to files ending with either the \".hive\"/\".reg\" extension, usually associated with Windows Registry backups.","references":["https://github.com/tccontre/Reg-Restore-Persistence-Mole"],"logsource":{"product":"windows","category":"file_access"},"tags":["attack.defense-impairment","attack.t1112","attack.persistence","detection.threat-hunting"],"path":"rules-threat-hunting/windows/file/file_access/file_access_win_susp_reg_and_hive.yml","techniques":["T1112"],"cves":[]},{"id":"35c55673-84ca-4e99-8d09-e334f3c29539","title":"Remote Registry Lateral Movement","author":"Sagie Dulce, Dekel Paz","status":"test","level":"high","date":"2022-01-01","modified":null,"description":"Detects remote RPC calls to modify the registry and possible execute code","references":["https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/0fa3191d-bb79-490a-81bd-54c2601b7a78","https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-RRP.md","https://github.com/zeronetworks/rpcfirewall","https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/"],"logsource":{"product":"rpc_firewall","category":"application"},"tags":["attack.lateral-movement","attack.defense-impairment","attack.t1112","attack.persistence"],"path":"rules/application/rpc_firewall/rpc_firewall_remote_registry_lateral_movement.yml","techniques":["T1112"],"cves":[]},{"id":"37b437cf-3fc5-4c8e-9c94-1d7c9aff842b","title":"Allow RDP Remote Assistance Feature","author":"frack113","status":"test","level":"medium","date":"2022-08-19","modified":"2023-08-17","description":"Detect enable rdp feature to allow specific user to rdp connect on the targeted machine","references":["https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1112/T1112.md"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_allow_rdp_remote_assistance_feature.yml","techniques":["T1112"],"cves":[]},{"id":"3ae1a046-f7db-439d-b7ce-b8b366b81fa6","title":"Disable Windows Security Center Notifications","author":"frack113","status":"test","level":"medium","date":"2022-08-19","modified":"2023-08-17","description":"Detect set UseActionCenterExperience to 0 to disable the Windows security center notification","references":["https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1112/T1112.md"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_disable_security_center_notifications.yml","techniques":["T1112"],"cves":[]},{"id":"3f6b7b62-61aa-45db-96bd-9c31b36b653c","title":"RDP Sensitive Settings Changed","author":"Samir Bousseaden, David ANDRE, Roberto Rodriguez @Cyb3rWard0g, Nasreddine Bencherchali","status":"test","level":"high","date":"2022-08-06","modified":"2025-11-22","description":"Detects tampering of RDP Terminal Service/Server sensitive settings.\nSuch as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections', etc.\n\nBelow is a list of registry keys/values that are monitored by this rule:\n\n- Shadow: Used to enable Remote Desktop shadowing, which allows an administrator to view or control a user's session.\n- DisableRemoteDesktopAntiAlias: Disables anti-aliasing for remote desktop sessions.\n- DisableSecuritySettings: Disables certain security settings for Remote Desktop connections.\n- fAllowUnsolicited: Allows unsolicited remote assistance offers.\n- fAllowUnsolicitedFullControl: Allows unsolicited remote assistance offers with full control.\n- InitialProgram: Specifies a program to run automatically when a user logs on to a remote computer.\n- ServiceDll: Used in RDP hijacking techniques to specify a custom DLL to be loaded by the Terminal Services service.\n- SecurityLayer: Specifies the security layer used for RDP connections.\n","references":["http://etutorials.org/Microsoft+Products/microsoft+windows+server+2003+terminal+services/Chapter+6+Registry/Registry+Keys+for+Terminal+Services/","http://woshub.com/rds-shadow-how-to-connect-to-a-user-session-in-windows-server-2012-r2/","https://admx.help/HKLM/SOFTWARE/Policies/Microsoft/Windows%20NT/Terminal%20Services","https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/","https://blog.sekoia.io/darkgate-internals/","https://blog.talosintelligence.com/understanding-the-phobos-affiliate-structure/","https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-63---disable-remote-desktop-anti-alias-setting-through-registry","https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-64---disable-remote-desktop-security-settings-through-registry","https://github.com/redcanaryco/atomic-red-team/blob/dd526047b8c399c312fee47d1e6fb531164da54d/atomics/T1112/T1112.yaml#L790","https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-terminalservices-rdp-winstationextensions-securitylayer","https://threathunterplaybook.com/hunts/windows/190407-RegModEnableRDPConnections/notebook.html","https://twitter.com/SagieSec/status/1469001618863624194?t=HRf0eA0W1YYzkTSHb-Ky1A&s=03","https://web.archive.org/web/20200929062532/https://blog.menasec.net/2019/02/threat-hunting-rdp-hijacking-via.html","https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_terminal_server_tampering.yml","techniques":["T1112"],"cves":[]},{"id":"487bb375-12ef-41f6-baae-c6a1572b4dd1","title":"Potential Persistence Via Outlook Today Page","author":"Tobias Michalski (Nextron Systems), David Bertho (@dbertho) & Eirik Sveen (@0xSV1), Storebrand","status":"test","level":"high","date":"2021-06-10","modified":"2024-08-07","description":"Detects potential persistence activity via outlook today page.\nAn attacker can set a custom page to execute arbitrary code and link to it via the registry values \"URL\" and \"UserDefinedUrl\".\n","references":["https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=74","https://trustedsec.com/blog/specula-turning-outlook-into-a-c2-with-one-registry-change"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_persistence_outlook_todaypage.yml","techniques":["T1112"],"cves":[]},{"id":"4ac5fc44-a601-4c06-955b-309df8c4e9d4","title":"OceanLotus Registry Activity","author":"megan201296, Jonhnathan Ribeiro","status":"test","level":"critical","date":"2019-04-14","modified":"2023-09-28","description":"Detects registry keys created in OceanLotus (also known as APT32) attacks","references":["https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/","https://github.com/eset/malware-ioc/tree/master/oceanlotus"],"logsource":{"product":"windows","category":"registry_event"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112","detection.emerging-threats"],"path":"rules-emerging-threats/2018/TA/APT32-Oceanlotus/registry_event_apt_oceanlotus_registry.yml","techniques":["T1112"],"cves":[]},{"id":"4f281b83-0200-4b34-bf35-d24687ea57c2","title":"ETW Logging Disabled For SCM","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"low","date":"2022-12-09","modified":"2023-08-17","description":"Detects changes to the \"TracingDisabled\" key in order to disable ETW logging for services.exe (SCM)","references":["http://redplait.blogspot.com/2020/07/whats-wrong-with-etw.html"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112","attack.t1685"],"path":"rules/windows/registry/registry_set/registry_set_services_etw_tamper.yml","techniques":["T1112","T1685"],"cves":[]},{"id":"5118765f-6657-4ddb-a487-d7bd673abbf1","title":"FlowCloud Registry Markers","author":"NVISO","status":"test","level":"critical","date":"2020-06-09","modified":"2024-03-20","description":"Detects FlowCloud malware registry markers from threat group TA410.\nThe malware stores its configuration in the registry alongside drivers utilized by the malware's keylogger components.\n","references":["https://www.proofpoint.com/us/blog/threat-insight/ta410-group-behind-lookback-attacks-against-us-utilities-sector-returns-new"],"logsource":{"product":"windows","category":"registry_event"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112","detection.emerging-threats"],"path":"rules-emerging-threats/2020/Malware/FlowCloud/registry_event_malware_flowcloud_markers.yml","techniques":["T1112"],"cves":[]},{"id":"53330955-dc52-487f-a3a2-da24dcff99b5","title":"New BgInfo.EXE Custom DB Path Registry Configuration","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-08-16","modified":null,"description":"Detects setting of a new registry database value related to BgInfo configuration. Attackers can for example set this value to save the results of the commands executed by BgInfo in order to exfiltrate information.","references":["Internal Research"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_bginfo_custom_db.yml","techniques":["T1112"],"cves":[]},{"id":"53ba33fd-3a50-4468-a5ef-c583635cfa92","title":"OilRig APT Schedule Task Persistence - System","author":"Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community","status":"test","level":"critical","date":"2018-03-23","modified":"2023-03-08","description":"Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report","references":["https://web.archive.org/web/20180402134442/https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018C.pdf"],"logsource":{"product":"windows","service":"system"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.defense-impairment","attack.g0049","attack.t1053.005","attack.s0111","attack.t1543.003","attack.t1112","attack.command-and-control","attack.t1071.004","detection.emerging-threats"],"path":"rules-emerging-threats/2018/TA/OilRig/win_system_apt_oilrig_mar18.yml","techniques":["T1053.005","T1543.003","T1112","T1071.004"],"cves":[]},{"id":"5a93eb65-dffa-4543-b761-94aa60098fb6","title":"Registry Hide Function from User","author":"frack113","status":"test","level":"medium","date":"2022-03-18","modified":"2023-08-17","description":"Detects registry modifications that hide internal tools or functions from the user (malware like Agent Tesla, Hermetic Wiper uses this technique)","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.001/T1564.001.md"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_hide_function_user.yml","techniques":["T1112"],"cves":[]},{"id":"5b175490-b652-4b02-b1de-5b5b4083c5f8","title":"RedMimicry Winnti Playbook Registry Manipulation","author":"Alexander Rausch","status":"test","level":"high","date":"2020-06-24","modified":"2021-11-27","description":"Detects actions caused by the RedMimicry Winnti playbook","references":["https://redmimicry.com"],"logsource":{"product":"windows","category":"registry_event"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/registry/registry_event/registry_event_redmimicry_winnti_reg.yml","techniques":["T1112"],"cves":[]},{"id":"5f60740a-f57b-4e76-82a1-15b6ff2cb134","title":"Registry Modification Via Regini.EXE","author":"Eli Salem, Sander Wiebing, oscd.community","status":"test","level":"low","date":"2020-10-08","modified":"2023-02-08","description":"Detects the execution of regini.exe which can be used to modify registry keys, the changes are imported from one or more text files.","references":["https://lolbas-project.github.io/lolbas/Binaries/Regini/","https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/regini"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/process_creation/proc_creation_win_regini_execution.yml","techniques":["T1112"],"cves":[]},{"id":"62e0298b-e994-4189-bc87-bc699aa62d97","title":"Potential Suspicious Registry File Imported Via Reg.EXE","author":"frack113, Nasreddine Bencherchali","status":"test","level":"medium","date":"2022-08-01","modified":"2023-02-05","description":"Detects the import of '.reg' files from suspicious paths using the 'reg.exe' utility","references":["https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/reg-import"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/process_creation/proc_creation_win_reg_import_from_suspicious_paths.yml","techniques":["T1112"],"cves":[]},{"id":"6763c6c8-bd01-4687-bc8d-4fa52cf8ba08","title":"Outlook EnableUnsafeClientMailRules Setting Enabled - Registry","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-02-08","modified":"2023-08-17","description":"Detects an attacker trying to enable the outlook security setting \"EnableUnsafeClientMailRules\" which allows outlook to run applications or execute macros","references":["https://support.microsoft.com/en-us/topic/how-to-control-the-rule-actions-to-start-an-application-or-run-a-macro-in-outlook-2016-and-outlook-2013-e4964b72-173c-959d-5d7b-ead562979048","https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=44"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_office_outlook_enable_unsafe_client_mail_rules.yml","techniques":["T1112"],"cves":[]},{"id":"68fcba0d-73a5-475e-a915-e8b4c576827e","title":"Remote Registry Management Using Reg Utility","author":"Teymur Kheirkhabarov, oscd.community","status":"test","level":"medium","date":"2019-10-22","modified":"2023-12-15","description":"Remote registry management using REG utility from non-admin workstation","references":["https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment"],"logsource":{"product":"windows","service":"security"},"tags":["attack.credential-access","attack.persistence","attack.discovery","attack.defense-impairment","attack.s0075","attack.t1012","attack.t1112","attack.t1552.002"],"path":"rules-placeholder/windows/builtin/security/win_security_remote_registry_management_via_reg.yml","techniques":["T1012","T1112","T1552.002"],"cves":[]},{"id":"73bba97f-a82d-42ce-b315-9182e76c57b1","title":"Imports Registry Key From a File","author":"Oddvar Moe, Sander Wiebing, oscd.community","status":"test","level":"medium","date":"2020-10-07","modified":"2024-03-13","description":"Detects the import of the specified file to the registry with regedit.exe.","references":["https://lolbas-project.github.io/lolbas/Binaries/Regedit/","https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/process_creation/proc_creation_win_regedit_import_keys.yml","techniques":["T1112"],"cves":[]},{"id":"77946e79-97f1-45a2-84b4-f37b5c0d8682","title":"Suspicious Registry Modification From ADS Via Regini.EXE","author":"Eli Salem, Sander Wiebing, oscd.community","status":"test","level":"high","date":"2020-10-12","modified":"2023-02-08","description":"Detects the import of an alternate data stream with regini.exe, regini.exe can be used to modify registry keys.","references":["https://lolbas-project.github.io/lolbas/Binaries/Regini/","https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/regini"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/process_creation/proc_creation_win_regini_ads.yml","techniques":["T1112"],"cves":[]},{"id":"7bdf2a7c-3acc-4091-9581-0a77dad1c5b5","title":"OilRig APT Registry Persistence","author":"Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community","status":"test","level":"critical","date":"2018-03-23","modified":"2023-03-08","description":"Detects OilRig registry persistence as reported by Nyotron in their March 2018 report","references":["https://web.archive.org/web/20180402134442/https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018C.pdf"],"logsource":{"product":"windows","category":"registry_event"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.defense-impairment","attack.g0049","attack.t1053.005","attack.s0111","attack.t1543.003","attack.t1112","attack.command-and-control","attack.t1071.004","detection.emerging-threats"],"path":"rules-emerging-threats/2018/TA/OilRig/registry_event_apt_oilrig_mar18.yml","techniques":["T1053.005","T1543.003","T1112","T1071.004"],"cves":[]},{"id":"7ec912f2-5175-4868-b811-ec13ad0f8567","title":"CVE-2020-1048 Exploitation Attempt - Suspicious New Printer Ports - Registry","author":"EagleEye Team, Florian Roth (Nextron Systems), NVISO","status":"test","level":"high","date":"2020-05-13","modified":"2024-03-25","description":"Detects changes to the \"Ports\" registry key with data that includes a Windows path or a file with a suspicious extension.\nThis could be an attempt to exploit CVE-2020-1048 - a Windows Print Spooler elevation of privilege vulnerability.\n","references":["https://windows-internals.com/printdemon-cve-2020-1048/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.execution","attack.defense-impairment","attack.t1112","cve.2020-1048","detection.emerging-threats"],"path":"rules-emerging-threats/2020/Exploits/CVE-2020-1048/registry_set_exploit_cve_2020_1048_new_printer_port.yml","techniques":["T1112"],"cves":["CVE-2020-1048"]},{"id":"7f4c43f9-b1a5-4c7d-b24a-b41bf3a3ebf2","title":"Registry Tampering by Potentially Suspicious Processes","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-08-13","modified":"2026-04-14","description":"Detects suspicious registry modifications made by suspicious processes such as script engine processes such as WScript, or CScript etc.\nThese processes are rarely used for legitimate registry modifications, and their activity may indicate an attempt to modify the registry\nwithout using standard tools like regedit.exe or reg.exe, potentially for evasion and persistence.\n","references":["https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/","https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/"],"logsource":{"product":"windows","category":"registry_event"},"tags":["attack.persistence","attack.execution","attack.defense-impairment","attack.t1112","attack.t1059.005"],"path":"rules/windows/registry/registry_event/registry_event_susp_process_registry_modification.yml","techniques":["T1112","T1059.005"],"cves":[]},{"id":"83314318-052a-4c90-a1ad-660ece38d276","title":"Blackbyte Ransomware Registry","author":"frack113","status":"test","level":"high","date":"2022-01-24","modified":"2025-10-21","description":"Detects specific windows registry modifications made by BlackByte ransomware variants.\nBlackByte set three different registry values to escalate privileges and begin setting the stage for lateral movement and encryption.\nThis rule triggers when any of the following registry keys are set to DWORD 1, however all three should be investigated as part of a larger BlackByte ransomware detection and response effort.\n","references":["https://redcanary.com/blog/blackbyte-ransomware/?utm_source=twitter&utm_medium=social","https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/blackbyte-ransomware-pt-1-in-depth-analysis/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Malware/BlackByte/registry_set_win_malware_blackbyte_privesc_registry.yml","techniques":["T1112"],"cves":[]},{"id":"85b88e05-dadc-430b-8a9e-53ff1cd30aae","title":"Potentially Suspicious Desktop Background Change Via Registry","author":"Nasreddine Bencherchali (Nextron Systems), Stephen Lincoln @slincoln-aiq (AttackIQ)","status":"test","level":"medium","date":"2023-12-21","modified":"2025-10-17","description":"Detects registry value settings that would replace the user's desktop background.\nThis is a common technique used by malware to change the desktop background to a ransom note or other image.\n","references":["https://www.attackiq.com/2023/09/20/emulating-rhysida/","https://research.checkpoint.com/2023/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/","https://www.trendmicro.com/en_us/research/23/h/an-overview-of-the-new-rhysida-ransomware.html","https://www.virustotal.com/gui/file/a864282fea5a536510ae86c77ce46f7827687783628e4f2ceb5bf2c41b8cd3c6/behavior","https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.WindowsDesktop::Wallpaper","https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.ControlPanelDisplay::CPL_Personalization_NoDesktopBackgroundUI"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.impact","attack.defense-impairment","attack.t1112","attack.t1491.001"],"path":"rules/windows/registry/registry_set/registry_set_desktop_background_change.yml","techniques":["T1112","T1491.001"],"cves":[]},{"id":"8839e550-52d7-4958-9f2f-e13c1e736838","title":"Security Event Logging Disabled via MiniNt Registry Key - Registry Set","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-04-09","modified":null,"description":"Detects the addition of the 'MiniNt' key to the registry. Upon a reboot, Windows Event Log service will stop writing events.\nWindows Event Log is a service that collects and stores event logs from the operating system and applications. It is an important component of Windows security and auditing.\nAdversary may want to disable this service to disable logging of security events which could be used to detect their activities.\n","references":["https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1685.001","attack.t1112","car.2022-03-001"],"path":"rules/windows/registry/registry_set/registry_set_create_minint_key.yml","techniques":["T1685.001","T1112"],"cves":[]},{"id":"8cbc9475-8d05-4e27-9c32-df960716c701","title":"Potentially Suspicious Desktop Background Change Using Reg.EXE","author":"Stephen Lincoln @slincoln-aiq (AttackIQ)","status":"test","level":"medium","date":"2023-12-21","modified":null,"description":"Detects the execution of \"reg.exe\" to alter registry keys that would replace the user's desktop background.\nThis is a common technique used by malware to change the desktop background to a ransom note or other image.\n","references":["https://www.attackiq.com/2023/09/20/emulating-rhysida/","https://research.checkpoint.com/2023/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/","https://www.trendmicro.com/en_us/research/23/h/an-overview-of-the-new-rhysida-ransomware.html","https://www.virustotal.com/gui/file/a864282fea5a536510ae86c77ce46f7827687783628e4f2ceb5bf2c41b8cd3c6/behavior","https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.WindowsDesktop::Wallpaper","https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.ControlPanelDisplay::CPL_Personalization_NoDesktopBackgroundUI"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.impact","attack.defense-impairment","attack.t1112","attack.t1491.001"],"path":"rules/windows/process_creation/proc_creation_win_reg_desktop_background_change.yml","techniques":["T1112","T1491.001"],"cves":[]},{"id":"8f02c935-effe-45b3-8fc9-ef8696a9e41d","title":"Non-privileged Usage of Reg or Powershell","author":"Teymur Kheirkhabarov (idea), Ryan Plas (rule), oscd.community","status":"test","level":"high","date":"2020-10-05","modified":"2024-12-01","description":"Search for usage of reg or Powershell by non-privileged users to modify service configuration in registry","references":["https://image.slidesharecdn.com/kheirkhabarovoffzonefinal-181117201458/95/hunting-for-privilege-escalation-in-windows-environment-20-638.jpg"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/process_creation/proc_creation_win_susp_non_priv_reg_or_ps.yml","techniques":["T1112"],"cves":[]},{"id":"8f3ab69a-aa22-4943-aa58-e0a52fdf6818","title":"User Shell Folders Registry Modification via CommandLine","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2026-01-05","modified":null,"description":"Detects modifications to User Shell Folders registry values via reg.exe or PowerShell, which could indicate persistence attempts.\nAttackers may modify User Shell Folders registry values to point to malicious executables or scripts that will be executed during startup.\nThis technique is often used to maintain persistence on a compromised system by ensuring that malicious payloads are executed automatically.\n","references":["https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.privilege-escalation","attack.defense-impairment","attack.t1547.001","attack.t1112"],"path":"rules/windows/process_creation/proc_creation_win_user_shell_folders_registry_modification.yml","techniques":["T1547.001","T1112"],"cves":[]},{"id":"90f342e1-1aaa-4e43-b092-39fda57ed11e","title":"ETW Logging Disabled For rpcrt4.dll","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"low","date":"2022-12-09","modified":"2023-08-17","description":"Detects changes to the \"ExtErrorInformation\" key in order to disable ETW logging for rpcrt4.dll","references":["http://redplait.blogspot.com/2020/07/whats-wrong-with-etw.html"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112","attack.t1685"],"path":"rules/windows/registry/registry_set/registry_set_rpcrt4_etw_tamper.yml","techniques":["T1112","T1685"],"cves":[]},{"id":"91239011-fe3c-4b54-9f24-15c86bb65913","title":"Office Macros Warning Disabled","author":"Trent Liffick (@tliffick), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2020-05-22","modified":"2024-03-19","description":"Detects registry changes to Microsoft Office \"VBAWarning\" to a value of \"1\" which enables the execution of all macros, whether signed or unsigned.","references":["https://twitter.com/inversecos/status/1494174785621819397","https://www.mcafee.com/blogs/other-blogs/mcafee-labs/zloader-with-a-new-infection-technique/","https://securelist.com/scarcruft-surveilling-north-korean-defectors-and-human-rights-activists/105074/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_office_vba_warnings_tamper.yml","techniques":["T1112"],"cves":[]},{"id":"919f2ef0-be2d-4a7a-b635-eb2b41fde044","title":"Disable Security Events Logging Adding Reg Key MiniNt","author":"Ilyas Ochkov, oscd.community","status":"test","level":"high","date":"2019-10-25","modified":"2021-11-27","description":"Detects the addition of a key 'MiniNt' to the registry. Upon a reboot, Windows Event Log service will stop writing events.","references":["https://twitter.com/0gtweet/status/1182516740955226112","https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/"],"logsource":{"product":"windows","category":"registry_event"},"tags":["attack.persistence","attack.defense-impairment","attack.t1685.001","attack.t1112","car.2022-03-001"],"path":"rules/windows/registry/registry_event/registry_event_disable_security_events_logging_adding_reg_key_minint.yml","techniques":["T1685.001","T1112"],"cves":[]},{"id":"921aa10f-2e74-4cca-9498-98f9ca4d6fdf","title":"Registry Modification Attempt Via VBScript","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-08-13","modified":null,"description":"Detects attempts to modify the registry using VBScript's CreateObject(\"Wscript.shell\") and RegWrite methods via common LOLBINs.\nIt could be an attempt to modify the registry for persistence without using straightforward methods like regedit.exe, reg.exe, or PowerShell.\nThreat Actors may use this technique to evade detection by security solutions that monitor for direct registry modifications through traditional tools.\n","references":["https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/","https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.execution","attack.defense-impairment","attack.t1112","attack.t1059.005"],"path":"rules/windows/process_creation/proc_creation_win_vbscript_registry_modification.yml","techniques":["T1112","T1059.005"],"cves":[]},{"id":"92b0b372-a939-44ed-a11b-5136cf680e27","title":"Blue Mockingbird - Registry","author":"Trent Liffick (@tliffick)","status":"test","level":"high","date":"2020-05-14","modified":"2023-08-17","description":"Attempts to detect system changes made by Blue Mockingbird","references":["https://redcanary.com/blog/blue-mockingbird-cryptominer/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.execution","attack.persistence","attack.defense-impairment","attack.t1112","attack.t1047","detection.emerging-threats"],"path":"rules-emerging-threats/2020/Malware/Blue-Mockingbird/registry_set_mal_blue_mockingbird.yml","techniques":["T1112","T1047"],"cves":[]},{"id":"96f697b0-b499-4e5d-9908-a67bec11cdb6","title":"Removal of Potential COM Hijacking Registry Keys","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"medium","date":"2020-05-02","modified":"2025-10-07","description":"Detects any deletion of entries in \".*\\shell\\open\\command\" registry keys.\nThese registry keys might have been used for COM hijacking activities by a threat actor or an attacker and the deletion could indicate steps to remove its tracks.\n","references":["https://github.com/OTRF/detection-hackathon-apt29/issues/7","https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.C.1_22A46621-7A92-48C1-81BF-B3937EB4FDC3.md","https://learn.microsoft.com/en-us/windows/win32/shell/launch","https://learn.microsoft.com/en-us/windows/win32/api/shobjidl_core/nn-shobjidl_core-iexecutecommand","https://learn.microsoft.com/en-us/windows/win32/shell/shell-and-managed-code"],"logsource":{"product":"windows","category":"registry_delete"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/registry/registry_delete/registry_delete_removal_com_hijacking_registry_key.yml","techniques":["T1112"],"cves":[]},{"id":"98dedfdd-8333-49d4-9f23-d7018cccae53","title":"Enable LM Hash Storage - ProcCreation","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-12-15","modified":"2023-12-22","description":"Detects changes to the \"NoLMHash\" registry value in order to allow Windows to store LM Hashes.\nBy setting this registry value to \"0\" (DWORD), Windows will be allowed to store a LAN manager hash of your password in Active Directory and local SAM databases.\n","references":["https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a","https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/prevent-windows-store-lm-hash-password","https://www.sans.org/blog/protecting-privileged-domain-accounts-lm-hashes-the-good-the-bad-and-the-ugly/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/process_creation/proc_creation_win_reg_nolmhash.yml","techniques":["T1112"],"cves":[]},{"id":"992dd79f-dde8-4bb0-9085-6350ba97cfb3","title":"New BgInfo.EXE Custom VBScript Registry Configuration","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-08-16","modified":null,"description":"Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom VBScript via \"BgInfo.exe\"","references":["Internal Research"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_bginfo_custom_vbscript.yml","techniques":["T1112"],"cves":[]},{"id":"9d3436ef-9476-4c43-acca-90ce06bdf33a","title":"DHCP Callout DLL Installation","author":"Dimitrios Slamaris","status":"test","level":"high","date":"2017-05-15","modified":"2023-08-17","description":"Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, which can be used to execute code in context of the DHCP server (restart required)","references":["https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html","https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx","https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.execution","attack.stealth","attack.defense-impairment","attack.t1574.001","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_dhcp_calloutdll.yml","techniques":["T1574.001","T1112"],"cves":[]},{"id":"9e3357ba-09d4-4fbd-a7c5-ad6386314513","title":"Change the Fax Dll","author":"frack113","status":"test","level":"high","date":"2022-07-17","modified":"2022-12-30","description":"Detect possible persistence using Fax DLL load when service restart","references":["https://twitter.com/dottor_morte/status/1544652325570191361","https://raw.githubusercontent.com/RiccardoAncarani/talks/master/F-Secure/unorthodox-lateral-movement.pdf"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_fax_dll_persistance.yml","techniques":["T1112"],"cves":[]},{"id":"a07f0359-4c90-4dc4-a681-8ffea40b4f47","title":"Service Binary in Suspicious Folder","author":"Florian Roth (Nextron Systems), frack113","status":"test","level":"high","date":"2022-05-02","modified":"2025-10-07","description":"Detect the creation of a service with a service binary located in a suspicious directory","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_creation_service_susp_folder.yml","techniques":["T1112"],"cves":[]},{"id":"a0bed973-45fa-4625-adb5-6ecdf9be70ac","title":"Microsoft Office Trusted Location Updated","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-06-21","modified":"2023-08-17","description":"Detects changes to the registry keys related to \"Trusted Location\" of Microsoft Office. Attackers might add additional trusted locations to avoid macro security restrictions.","references":["https://admx.help/?Category=Office2016&Policy=excel16.Office.Microsoft.Policies.Windows::L_TrustedLoc01"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112","detection.threat-hunting"],"path":"rules-threat-hunting/windows/registry/registry_set/registry_set_office_trusted_location.yml","techniques":["T1112"],"cves":[]},{"id":"a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd","title":"Macro Enabled In A Potentially Suspicious Document","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-06-21","modified":"2023-08-17","description":"Detects registry changes to Office trust records where the path is located in a potentially suspicious location","references":["https://twitter.com/inversecos/status/1494174785621819397","Internal Research"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_office_trust_record_susp_location.yml","techniques":["T1112"],"cves":[]},{"id":"a1e11042-a74a-46e6-b07c-c4ce8ecc239b","title":"Potential Persistence Via Event Viewer Events.asp","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-02-17","modified":"2023-03-05","description":"Detects potential registry persistence technique using the Event Viewer \"Events.asp\" technique","references":["https://twitter.com/nas_bench/status/1626648985824788480","https://admx.help/?Category=Windows_7_2008R2&Policy=Microsoft.Policies.InternetCommunicationManagement::EventViewer_DisableLinks","https://www.hexacorn.com/blog/2019/02/15/beyond-good-ol-run-key-part-103/","https://github.com/redcanaryco/atomic-red-team/blob/f296668303c29d3f4c07e42bdd2b28d8dd6625f9/atomics/T1112/T1112.md"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_persistence_event_viewer_events_asp.yml","techniques":["T1112"],"cves":[]},{"id":"a2863fbc-d5cb-48d5-83fb-d976d4b1743b","title":"RDP Sensitive Settings Changed to Zero","author":"Samir Bousseaden, David ANDRE, Roberto Rodriguez @Cyb3rWard0g, Nasreddine Bencherchali","status":"test","level":"medium","date":"2022-09-29","modified":"2022-11-26","description":"Detects tampering of RDP Terminal Service/Server sensitive settings.\nSuch as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections', etc.\n","references":["https://web.archive.org/web/20200929062532/https://blog.menasec.net/2019/02/threat-hunting-rdp-hijacking-via.html","http://woshub.com/rds-shadow-how-to-connect-to-a-user-session-in-windows-server-2012-r2/","https://twitter.com/SagieSec/status/1469001618863624194?t=HRf0eA0W1YYzkTSHb-Ky1A&s=03","https://threathunterplaybook.com/hunts/windows/190407-RegModEnableRDPConnections/notebook.html","https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/","http://etutorials.org/Microsoft+Products/microsoft+windows+server+2003+terminal+services/Chapter+6+Registry/Registry+Keys+for+Terminal+Services/","https://admx.help/HKLM/SOFTWARE/Policies/Microsoft/Windows%20NT/Terminal%20Services"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_terminal_server_suspicious.yml","techniques":["T1112"],"cves":[]},{"id":"a4c90ea1-2634-4ca0-adbb-35eae169b6fc","title":"ETW Logging Disabled In .NET Processes - Registry","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"high","date":"2020-06-05","modified":"2022-12-20","description":"Potential adversaries stopping ETW providers recording loaded .NET assemblies.","references":["https://twitter.com/_xpn_/status/1268712093928378368","https://social.msdn.microsoft.com/Forums/vstudio/en-US/0878832e-39d7-4eaf-8e16-a729c4c40975/what-can-i-use-e13c0d23ccbc4e12931bd9cc2eee27e4-for?forum=clr","https://github.com/dotnet/runtime/blob/ee2355c801d892f2894b0f7b14a20e6cc50e0e54/docs/design/coreclr/jit/viewing-jit-dumps.md#setting-configuration-variables","https://github.com/dotnet/runtime/blob/f62e93416a1799aecc6b0947adad55a0d9870732/src/coreclr/src/inc/clrconfigvalues.h#L35-L38","https://github.com/dotnet/runtime/blob/7abe42dc1123722ed385218268bb9fe04556e3d3/src/coreclr/src/inc/clrconfig.h#L33-L39","https://github.com/dotnet/runtime/search?p=1&q=COMPlus_&unscoped_q=COMPlus_","https://bunnyinside.com/?term=f71e8cb9c76a","http://managed670.rssing.com/chan-5590147/all_p1.html","https://github.com/dotnet/runtime/blob/4f9ae42d861fcb4be2fcd5d3d55d5f227d30e723/docs/coding-guidelines/clr-jit-coding-conventions.md#1412-disabling-code","https://i.blackhat.com/EU-21/Wednesday/EU-21-Teodorescu-Veni-No-Vidi-No-Vici-Attacks-On-ETW-Blind-EDRs.pdf"],"logsource":{"product":"windows","service":"security"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112","attack.t1685"],"path":"rules/windows/builtin/security/win_security_dot_net_etw_tamper.yml","techniques":["T1112","T1685"],"cves":[]},{"id":"ac9159cc-c364-4304-8f0a-d63fc1a0aabb","title":"ClickOnce Trust Prompt Tampering","author":"@SerkinValery, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-06-12","modified":"2023-08-17","description":"Detects changes to the ClickOnce trust prompt registry key in order to enable an installation from different locations such as the Internet.","references":["https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5","https://learn.microsoft.com/en-us/visualstudio/deployment/how-to-configure-the-clickonce-trust-prompt-behavior"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_clickonce_trust_prompt.yml","techniques":["T1112"],"cves":[]},{"id":"b0524451-19af-4efa-a46f-562a977f792e","title":"ShimCache Flush","author":"Florian Roth (Nextron Systems)","status":"stable","level":"high","date":"2021-02-01","modified":null,"description":"Detects actions that clear the local ShimCache and remove forensic evidence","references":["https://medium.com/@blueteamops/shimcache-flush-89daff28d15e"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/process_creation/proc_creation_win_rundll32_susp_shimcache_flush.yml","techniques":["T1112"],"cves":[]},{"id":"b7b19cb6-9b32-4fc4-a108-73f19acfe262","title":"Suspicious VBoxDrvInst.exe Parameters","author":"Konstantin Grishchenko, oscd.community","status":"test","level":"medium","date":"2020-10-06","modified":"2021-11-27","description":"Detect VBoxDrvInst.exe run with parameters allowing processing INF file.\nThis allows to create values in the registry and install drivers.\nFor example one could use this technique to obtain persistence via modifying one of Run or RunOnce registry keys\n","references":["https://github.com/LOLBAS-Project/LOLBAS/blob/4db780e0f0b2e2bb8cb1fa13e09196da9b9f1834/yml/LOLUtilz/OtherBinaries/VBoxDrvInst.yml","https://twitter.com/pabraeken/status/993497996179492864"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/process_creation/proc_creation_win_virtualbox_vboxdrvinst_execution.yml","techniques":["T1112"],"cves":[]},{"id":"b7e2a8d4-74bb-4b78-adc9-3f92af2d4829","title":"Reg Add Suspicious Paths","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-08-19","modified":"2022-10-10","description":"Detects when an adversary uses the reg.exe utility to add or modify new keys or subkeys","references":["https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1112/T1112.md","https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1562.001/T1562.001.md","https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112","attack.t1685"],"path":"rules/windows/process_creation/proc_creation_win_reg_susp_paths.yml","techniques":["T1112","T1685"],"cves":[]},{"id":"ba226dcf-d390-4642-b9af-b534872f1156","title":"Windows Event Log Access Tampering Via Registry","author":"X__Junior","status":"experimental","level":"high","date":"2025-01-16","modified":"2025-08-16","description":"Detects changes to the Windows EventLog channel permission values. It focuses on changes to the Security Descriptor Definition Language (SDDL) string, as modifications to these values can restrict access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify a event log channel. Upon execution, the user shouldn't be able to access the event log channel via the event viewer or via utilities such as \"Get-EventLog\" or \"wevtutil\".\n","references":["https://www.atomicredteam.io/atomic-red-team/atomics/T1562.002#atomic-test-8---modify-event-log-channel-access-permissions-via-registry---powershell","https://www.youtube.com/watch?v=uSYvHUVU8xY","https://learn.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-definition-language"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.defense-impairment","attack.t1547.001","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_disable_windows_event_log_access.yml","techniques":["T1547.001","T1112"],"cves":[]},{"id":"bf4fc428-dcc3-4bbd-99fe-2422aeee2544","title":"ETW Logging Disabled In .NET Processes - Sysmon Registry","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"high","date":"2020-06-05","modified":"2023-08-17","description":"Potential adversaries stopping ETW providers recording loaded .NET assemblies.","references":["https://twitter.com/_xpn_/status/1268712093928378368","https://social.msdn.microsoft.com/Forums/vstudio/en-US/0878832e-39d7-4eaf-8e16-a729c4c40975/what-can-i-use-e13c0d23ccbc4e12931bd9cc2eee27e4-for?forum=clr","https://github.com/dotnet/runtime/blob/ee2355c801d892f2894b0f7b14a20e6cc50e0e54/docs/design/coreclr/jit/viewing-jit-dumps.md#setting-configuration-variables","https://github.com/dotnet/runtime/blob/f62e93416a1799aecc6b0947adad55a0d9870732/src/coreclr/src/inc/clrconfigvalues.h#L35-L38","https://github.com/dotnet/runtime/blob/7abe42dc1123722ed385218268bb9fe04556e3d3/src/coreclr/src/inc/clrconfig.h#L33-L39","https://github.com/dotnet/runtime/search?p=1&q=COMPlus_&unscoped_q=COMPlus_","https://bunnyinside.com/?term=f71e8cb9c76a","http://managed670.rssing.com/chan-5590147/all_p1.html","https://github.com/dotnet/runtime/blob/4f9ae42d861fcb4be2fcd5d3d55d5f227d30e723/docs/coding-guidelines/clr-jit-coding-conventions.md#1412-disabling-code","https://blog.xpnsec.com/hiding-your-dotnet-complus-etwenabled/","https://i.blackhat.com/EU-21/Wednesday/EU-21-Teodorescu-Veni-No-Vidi-No-Vici-Attacks-On-ETW-Blind-EDRs.pdf"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112","attack.t1685"],"path":"rules/windows/registry/registry_set/registry_set_dot_net_etw_tamper.yml","techniques":["T1112","T1685"],"cves":[]},{"id":"c0580559-a6bd-4ef6-b9b7-83703d98b561","title":"OilRig APT Schedule Task Persistence - Security","author":"Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community","status":"test","level":"critical","date":"2018-03-23","modified":"2023-03-08","description":"Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report","references":["https://web.archive.org/web/20180402134442/https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018C.pdf"],"logsource":{"product":"windows","service":"security"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.defense-impairment","attack.g0049","attack.t1053.005","attack.s0111","attack.t1543.003","attack.t1112","attack.command-and-control","attack.t1071.004","detection.emerging-threats"],"path":"rules-emerging-threats/2018/TA/OilRig/win_security_apt_oilrig_mar18.yml","techniques":["T1053.005","T1543.003","T1112","T1071.004"],"cves":[]},{"id":"c0e0bdec-3e3d-47aa-9974-05539c999c89","title":"Registry Modification for OCI DLL Redirection","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2026-01-24","modified":null,"description":"Detects registry modifications related to 'OracleOciLib' and 'OracleOciLibPath' under 'MSDTC' settings.\nThreat actors may modify these registry keys to redirect the loading of 'oci.dll' to a malicious DLL, facilitating phantom DLL hijacking via the MSDTC service.\n","references":["https://www.crowdstrike.com/en-us/blog/4-ways-adversaries-hijack-dlls/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.privilege-escalation","attack.execution","attack.stealth","attack.defense-impairment","attack.t1112","attack.t1574.001"],"path":"rules/windows/registry/registry_set/registry_set_potential_oci_dll_redirection.yml","techniques":["T1112","T1574.001"],"cves":[]},{"id":"c3198a27-23a0-4c2c-af19-e5328d49680e","title":"Blue Mockingbird","author":"Trent Liffick (@tliffick)","status":"test","level":"high","date":"2020-05-14","modified":"2022-10-09","description":"Attempts to detect system changes made by Blue Mockingbird","references":["https://redcanary.com/blog/blue-mockingbird-cryptominer/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.execution","attack.defense-impairment","attack.t1112","attack.t1047","detection.emerging-threats"],"path":"rules-emerging-threats/2020/Malware/Blue-Mockingbird/proc_creation_win_malware_blue_mockingbird.yml","techniques":["T1112","T1047"],"cves":[]},{"id":"c420410f-c2d8-4010-856b-dffe21866437","title":"Enable LM Hash Storage","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-12-15","modified":null,"description":"Detects changes to the \"NoLMHash\" registry value in order to allow Windows to store LM Hashes.\nBy setting this registry value to \"0\" (DWORD), Windows will be allowed to store a LAN manager hash of your password in Active Directory and local SAM databases.\n","references":["https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a","https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/prevent-windows-store-lm-hash-password","https://www.sans.org/blog/protecting-privileged-domain-accounts-lm-hashes-the-good-the-bad-and-the-ugly/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_system_lsa_nolmhash.yml","techniques":["T1112"],"cves":[]},{"id":"c453ab7a-1f5c-4716-a3b4-dea8135fb43a","title":"Registry Manipulation via WMI Stdregprov","author":"Daniel Koifman (KoifSec)","status":"experimental","level":"medium","date":"2025-07-30","modified":"2026-06-19","description":"Detects the usage of wmic.exe to modify Windows registry via the WMI StdRegProv class write methods (CreateKey, DeleteKey, SetStringValue, etc.).\nThis behaviour could be potentially suspicious because it uses an alternative method to modify registry keys instead of legitimate registry tools like reg.exe or regedit.exe.\nAttackers specifically choose this technique to evade detection and bypass security monitoring focused on traditional registry modification commands.\n","references":["https://www.bitdefender.com/en-us/blog/businessinsights/shrinklocker-decryptor-from-friend-to-foe-and-back-again","https://trustedsec.com/blog/command-line-underdog-wmic-in-action","https://trustedsec.com/blog/wmi-for-script-kiddies","https://learn.microsoft.com/en-us/previous-versions/windows/desktop/regprov/stdregprov"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1047","attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/process_creation/proc_creation_win_wmic_stdregprov_reg_modification.yml","techniques":["T1047","T1112"],"cves":[]},{"id":"c74d7efc-8826-45d9-b8bb-f04fac9e4eff","title":"Run Once Task Configuration in Registry","author":"Avneet Singh @v3t0_, oscd.community","status":"test","level":"medium","date":"2020-11-15","modified":"2024-03-25","description":"Rule to detect the configuration of Run Once registry key. Configured payload can be run by runonce.exe /AlternateShellStartup","references":["https://twitter.com/pabraeken/status/990717080805789697","https://lolbas-project.github.io/lolbas/Binaries/Runonce/"],"logsource":{"product":"windows","category":"registry_event"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/registry/registry_event/registry_event_runonce_persistence.yml","techniques":["T1112"],"cves":[]},{"id":"c9e5f013-4a6f-4d8c-9b0e-f7a4c3d26e95","title":"Potentially Suspicious Image Load of Offreg.dll","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2026-07-23","modified":null,"description":"Detects potentially suspicious loading of the Offline Registry Library (offreg.dll).\nOffreg.dll enables direct read/write access to offline registry hives without invoking the Windows Registry API,\nbypassing its associated audit logging and telemetry. Attackers may abuse this to stealthily modify registry hives\nwhile evading detection mechanisms that rely on standard registry event logs.\n","references":["https://learn.microsoft.com/en-us/windows/win32/devnotes/about-the-offline-registry-library","https://github.com/MSNightmare/LegacyHive"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.defense-impairment","attack.persistence","attack.t1112"],"path":"rules/windows/image_load/image_load_susp_offreg_dll_load.yml","techniques":["T1112"],"cves":[]},{"id":"cd277474-5c52-4423-a52b-ac2d7969902f","title":"New BgInfo.EXE Custom WMI Query Registry Configuration","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-08-16","modified":null,"description":"Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom WMI query via \"BgInfo.exe\"","references":["Internal Research"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_bginfo_custom_wmi_query.yml","techniques":["T1112"],"cves":[]},{"id":"ce6e34ca-966d-41c9-8d93-5b06c8b97a06","title":"OilRig APT Activity","author":"Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community","status":"test","level":"critical","date":"2018-03-23","modified":"2023-03-08","description":"Detects OilRig activity as reported by Nyotron in their March 2018 report","references":["https://web.archive.org/web/20180402134442/https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018C.pdf"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.defense-impairment","attack.g0049","attack.t1053.005","attack.s0111","attack.t1543.003","attack.t1112","attack.command-and-control","attack.t1071.004","detection.emerging-threats"],"path":"rules-emerging-threats/2018/TA/OilRig/proc_creation_win_apt_oilrig_mar18.yml","techniques":["T1053.005","T1543.003","T1112","T1071.004"],"cves":[]},{"id":"d3abac66-f11c-4ed0-8acb-50cc29c97eed","title":"NetNTLM Downgrade Attack","author":"Florian Roth (Nextron Systems), wagga","status":"test","level":"high","date":"2018-03-20","modified":"2022-10-09","description":"Detects NetNTLM downgrade attack","references":["https://www.optiv.com/blog/post-exploitation-using-netntlm-downgrade-attacks"],"logsource":{"product":"windows","service":"security"},"tags":["attack.persistence","attack.defense-impairment","attack.t1685","attack.t1112"],"path":"rules/windows/builtin/security/win_security_net_ntlm_downgrade.yml","techniques":["T1685","T1112"],"cves":[]},{"id":"d67572a0-e2ec-45d6-b8db-c100d14b8ef2","title":"NetNTLM Downgrade Attack - Registry","author":"Florian Roth (Nextron Systems), wagga, Nasreddine Bencherchali (Splunk STRT)","status":"test","level":"high","date":"2018-03-20","modified":"2024-12-03","description":"Detects NetNTLM downgrade attack","references":["https://web.archive.org/web/20171113231705/https://www.optiv.com/blog/post-exploitation-using-netntlm-downgrade-attacks","https://www.ultimatewindowssecurity.com/wiki/page.aspx?spid=NSrpcservers"],"logsource":{"product":"windows","category":"registry_event"},"tags":["attack.persistence","attack.defense-impairment","attack.t1685","attack.t1112"],"path":"rules/windows/registry/registry_event/registry_event_net_ntlm_downgrade.yml","techniques":["T1685","T1112"],"cves":[]},{"id":"d6a9b252-c666-4de6-8806-5561bbbd3bdc","title":"Wdigest Enable UseLogonCredential","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"high","date":"2019-09-12","modified":"2023-08-17","description":"Detects potential malicious modification of the property value of UseLogonCredential from HKLM:\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\WDigest to enable clear-text credentials","references":["https://threathunterplaybook.com/hunts/windows/190510-RegModWDigestDowngrade/notebook.html","https://support.microsoft.com/en-us/topic/microsoft-security-advisory-update-to-improve-credentials-protection-and-management-may-13-2014-93434251-04ac-b7f3-52aa-9f951c14b649","https://github.com/redcanaryco/atomic-red-team/blob/73fcfa1d4863f6a4e17f90e54401de6e30a312bb/atomics/T1112/T1112.md#atomic-test-3---modify-registry-to-store-logon-credentials"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_wdigest_enable_uselogoncredential.yml","techniques":["T1112"],"cves":[]},{"id":"d6ce7ebd-260b-4323-9768-a9631c8d4db2","title":"RestrictedAdminMode Registry Value Tampering","author":"frack113","status":"test","level":"high","date":"2023-01-13","modified":"2024-08-23","description":"Detects changes to the \"DisableRestrictedAdmin\" registry value in order to disable or enable RestrictedAdmin mode.\nRestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.\nThis prevents your credentials from being harvested during the initial connection process if the remote server has been compromise\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/a8e3cf63e97b973a25903d3df9fd55da6252e564/atomics/T1112/T1112.md","https://social.technet.microsoft.com/wiki/contents/articles/32905.remote-desktop-services-enable-restricted-admin-mode.aspx"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_lsa_disablerestrictedadmin.yml","techniques":["T1112"],"cves":[]},{"id":"d88d0ab2-e696-4d40-a2ed-9790064e66b3","title":"Modification of IE Registry Settings","author":"frack113","status":"test","level":"low","date":"2022-01-22","modified":"2025-10-22","description":"Detects modification of the registry settings used for Internet Explorer and other Windows components that use these settings. An attacker can abuse this registry key to add a domain to the trusted sites Zone or insert JavaScript for persistence","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-4---add-domain-to-trusted-sites-zone","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-5---javascript-in-registry"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_persistence_ie.yml","techniques":["T1112"],"cves":[]},{"id":"dd3ee8cc-f751-41c9-ba53-5a32ed47e563","title":"Registry Modification of MS-settings Protocol Handler","author":"frack113, Swachchhanda Shrawan Poudel (Nextron Systems)","status":"test","level":"medium","date":"2021-12-20","modified":"2026-01-24","description":"Detects registry modifications to the 'ms-settings' protocol handler, which is frequently targeted for UAC bypass or persistence.\nAttackers can modify this registry to execute malicious code with elevated privileges by hijacking the command execution path.\n","references":["https://thedfirreport.com/2021/12/13/diavol-ransomware/","https://www.trendmicro.com/en_us/research/25/f/water-curse.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.persistence","attack.defense-impairment","attack.t1548.002","attack.t1546.001","attack.t1112"],"path":"rules/windows/process_creation/proc_creation_win_susp_registry_modification_of_ms_setting_protocol_handler.yml","techniques":["T1548.002","T1546.001","T1112"],"cves":[]},{"id":"ddd171b5-2cc6-4975-9e78-f0eccd08cc76","title":"Potential Persistence Via Outlook Home Page","author":"Tobias Michalski (Nextron Systems), David Bertho (@dbertho) & Eirik Sveen (@0xSV1), Storebrand","status":"test","level":"high","date":"2021-06-09","modified":"2024-08-07","description":"Detects potential persistence activity via outlook home page.\nAn attacker can set a home page to achieve code execution and persistence by editing the WebView registry keys.\n","references":["https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=70","https://support.microsoft.com/en-us/topic/outlook-home-page-feature-is-missing-in-folder-properties-d207edb7-aa02-46c5-b608-5d9dbed9bd04?ui=en-us&rs=en-us&ad=us","https://trustedsec.com/blog/specula-turning-outlook-into-a-c2-with-one-registry-change"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_persistence_outlook_homepage.yml","techniques":["T1112"],"cves":[]},{"id":"e2482f8d-3443-4237-b906-cc145d87a076","title":"Disable Internal Tools or Feature in Registry","author":"frack113, Nasreddine Bencherchali (Nextron Systems), CrimpSec","status":"test","level":"medium","date":"2022-03-18","modified":"2025-06-04","description":"Detects registry modifications that change features of internal Windows tools (malware like Agent Tesla uses this technique)","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md","https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions","https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html","https://www.malwarebytes.com/blog/detections/pum-optional-nodispbackgroundpage","https://www.malwarebytes.com/blog/detections/pum-optional-nodispcpl","https://bazaar.abuse.ch/sample/7bde840c7e8c36dce4c3bac937bcf39f36a6f118001b406bfbbc25451ce44fb4/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_disable_function_user.yml","techniques":["T1112"],"cves":[]},{"id":"e3fdf743-f05b-4051-990a-b66919be1743","title":"Change User Account Associated with the FAX Service","author":"frack113","status":"test","level":"high","date":"2022-07-17","modified":"2022-12-30","description":"Detect change of the user account associated with the FAX service to avoid the escalation problem.","references":["https://twitter.com/dottor_morte/status/1544652325570191361","https://raw.githubusercontent.com/RiccardoAncarani/talks/master/F-Secure/unorthodox-lateral-movement.pdf"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_fax_change_service_user.yml","techniques":["T1112"],"cves":[]},{"id":"e61e8a88-59a9-451c-874e-70fcc9740d67","title":"New DNS ServerLevelPluginDll Installed","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2017-05-08","modified":"2023-08-17","description":"Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)","references":["https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83","https://blog.3or.de/hunting-dns-server-level-plugin-dll-injection.html"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.execution","attack.stealth","attack.defense-impairment","attack.t1574.001","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_dns_server_level_plugin_dll.yml","techniques":["T1574.001","T1112"],"cves":[]},{"id":"f63b56ee-3f79-4b8a-97fb-5c48007e8573","title":"New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2017-05-08","modified":"2023-02-05","description":"Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)","references":["https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83","https://blog.3or.de/hunting-dns-server-level-plugin-dll-injection.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.persistence","attack.execution","attack.stealth","attack.defense-impairment","attack.t1574.001","attack.t1112"],"path":"rules/windows/process_creation/proc_creation_win_dnscmd_install_new_server_level_plugin_dll.yml","techniques":["T1574.001","T1112"],"cves":[]},{"id":"f742bde7-9528-42e5-bd82-84f51a8387d2","title":"Uncommon Microsoft Office Trusted Location Added","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-06-21","modified":"2023-09-29","description":"Detects changes to registry keys related to \"Trusted Location\" of Microsoft Office where the path is set to something uncommon. Attackers might add additional trusted locations to avoid macro security restrictions.","references":["Internal Research","https://admx.help/?Category=Office2016&Policy=excel16.Office.Microsoft.Policies.Windows::L_TrustedLoc01"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_office_trusted_location_uncommon.yml","techniques":["T1112"],"cves":[]},{"id":"f7997770-92c3-4ec9-b112-774c4ef96f96","title":"Winlogon AllowMultipleTSSessions Enable","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-09-09","modified":"2023-08-17","description":"Detects when the 'AllowMultipleTSSessions' value is enabled.\nWhich allows for multiple Remote Desktop connection sessions to be opened at once.\nThis is often used by attacker as a way to connect to an RDP session without disconnecting the other users\n","references":["http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_winlogon_allow_multiple_tssessions.yml","techniques":["T1112"],"cves":[]},{"id":"f7f9ab88-7557-4a69-b30e-0a8f91b3a0e7","title":"Registry Entries For Azorult Malware","author":"Trent Liffick","status":"test","level":"critical","date":"2020-05-08","modified":"2021-11-27","description":"Detects the presence of a registry key created during Azorult execution","references":["https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.azoruit.a"],"logsource":{"product":"windows","category":"registry_event"},"tags":["attack.persistence","attack.execution","attack.defense-impairment","attack.t1112"],"path":"rules/windows/registry/registry_event/registry_event_mal_azorult.yml","techniques":["T1112"],"cves":[]},{"id":"fdbf0b9d-0182-4c43-893b-a1eaab92d085","title":"Potential Persistence Via Custom Protocol Handler","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-05-30","modified":"2023-05-12","description":"Detects potential persistence activity via the registering of a new custom protocole handlers. While legitimate applications register protocole handlers often times during installation. And attacker can abuse this by setting a custom handler to be used as a persistence mechanism.","references":["https://ladydebug.com/blog/2019/06/21/custom-protocol-handler-cph/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_persistence_custom_protocol_handler.yml","techniques":["T1112"],"cves":[]},{"id":"fecfd1a1-cc78-4313-a1ea-2ee2e8ec27a7","title":"PowerShell Logging Disabled Via Registry Key Tampering","author":"frack113","status":"test","level":"high","date":"2022-04-02","modified":"2023-08-17","description":"Detects changes to the registry for the currently logged-in user. In order to disable PowerShell module logging, script block logging or transcription and script execution logging","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-32---windows-powershell-logging-disabled"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.stealth","attack.defense-impairment","attack.t1564.001","attack.t1112","attack.persistence"],"path":"rules/windows/registry/registry_set/registry_set_powershell_logging_disabled.yml","techniques":["T1564.001","T1112"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2025-30400","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-26169","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-4577","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2023-38831","state":"mapped","mapping_types":["secondary_impact"]}],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}