Modify Registry

Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution. Access to specific areas of the Registry depends on account permissions, with some keys requiring administrator-level access. The built-in Windows command-line utility Reg may be used for local or remote Registry modification.¹ Other tools, such as remote access tools, may also contain functionality to interact with the Registry through the Windows API. The Registry may be modified in order to hide configuration information or malicious payloads via Obfuscated Files or Information.²³⁴⁵ The Registry may also be modified to impair defenses, such as by enabling macros for all Microsoft Office products, allowing privilege escalation without alerting the user, increasing the maximum number of allowed outbound requests, and/or modifying systems to store plaintext credentials in memory.⁶⁷ The Registry of a remote system may be modified to aid in execution of files as part of lateral movement. It requires the remote Registry service to be running on the target system.⁸ Often Valid Accounts are required, along with access to the remote system's SMB/Windows Admin Shares for RPC communication. Finally, Registry modifications may also include actions to hide keys, such as prepending key names with a null character, which will cause an error and/or be ignored when read via Reg or other utilities using the Win32 API.⁹ Adversaries may abuse these pseudo-hidden keys to conceal payloads/commands used to maintain persistence.¹⁰¹¹

1. Microsoft Reg
2. Unit42 BabyShark Feb 2019
3. Avaddon Ransomware 2021
4. Microsoft BlackCat Jun 2022
5. CISA Russian Gov Critical Infra 2018
6. CISA LockBit 2023
7. Unit42 BabyShark Feb 2019
8. Microsoft Remote
9. Microsoft Reghide NOV 2006
10. TrendMicro POWELIKS AUG 2014
11. SpectorOps Hiding Reg Jul 2017

使用该技术的组织

断言

尚无指向该技术的公开断言。

记录自动入库·未人工复核；置信度与有效期按引用读取。