Threat briefs

Adversaries, including the Agent Tesla malware, modify Windows Registry keys under Explorer Policies to impair user access to system tools and desktop functionality.

Adversaries frequently employ PowerShell commands within Windows Registry Run keys to achieve persistence and facilitate stealthy execution upon system startup.

Attackers achieve persistence by registering malicious XLL add-ins in the Windows registry, causing them to load automatically when Excel is launched.

Adversaries can achieve persistence and privilege escalation by installing malicious shim databases to intercept and redirect application execution.

Adversaries may achieve persistence or privilege escalation by hijacking COM object registrations associated with scrobj.dll to execute arbitrary scriptlet code.

Adversaries can achieve persistence and code execution by modifying the Outlook WebView registry keys to point to a malicious URL.

Detection of unauthorized modifications to Internet Explorer registry keys, which can be leveraged by attackers for persistence or defense impairment.

An adversary can achieve persistence or defense impairment by modifying Windows registry keys to redirect Event Viewer's 'Events.asp' link handling to a malicious binary or command line.

Attackers may modify the DisableRestrictedAdmin registry value to impair credential protection mechanisms by disabling Restricted Admin mode for Remote Desktop Services.

Adversaries can install malicious root or CA certificates into the Windows registry to facilitate traffic interception, bypass security controls, and establish persistence.

Malicious actors, including those behind Agent Tesla and Hermetic Wiper, utilize specific registry modifications to hide system interface elements from users as a defensive impairment technique.

Adversaries frequently modify Windows registry keys to prevent users from viewing hidden and system files, a technique used to maintain persistence and camouflage malicious artifacts.

Adversaries modify Windows registry keys to hide file extensions and system files, facilitating the masquerading of malicious executables.

An adversary or administrator can modify the DisallowRun registry key to prevent specific applications from executing, a technique often used to impair security tools or enforce restrictive environment configurations.

Adversaries disable the Windows Firewall by modifying specific registry keys to bypass network security controls and facilitate lateral movement or data exfiltration.

Attackers may modify registry-based Security Descriptor Definition Language (SDDL) strings for Windows Event Log channels to impair defensive monitoring by restricting access to log data.

Adversaries, including those observed deploying LockBit Black, modify registry keys to disable the Windows Privacy Settings Experience as part of a defense impairment strategy.

Adversaries, including operators of Agent Tesla and Batloader, modify Windows Registry keys to disable system administration tools and security features, hindering incident response and persistence.

Adversaries can gain persistence or bypass network controls by installing unauthorized Chrome VPN extensions through the Windows Registry.

This brief documents detection logic for monitoring unauthorized modifications to Windows Session Manager registry keys, which are often leveraged by attackers for persistence and privilege escalation.

Adversaries frequently modify Windows Autostart Extensibility Point (ASEP) registry keys to establish persistence, requiring robust monitoring of registry set events.

Adversaries utilize the legitimate Windows Backup utility to delete system and state backups as a destructive measure to inhibit recovery during ransomware operations.

This brief documents detection logic for identifying potentially malicious registry modifications using the native Windows reg.exe utility to target sensitive system and persistence-related paths.

Adversaries manipulate the DisableRestrictedAdmin registry key to weaken Remote Desktop security, facilitating credential harvesting through the capture of reusable credentials during remote sessions.

Detection of unauthorized modifications to BitLocker registry keys using the Windows command-line utility reg.exe, a technique used by ransomware actors to alter encryption settings.

This brief documents detection logic for PowerShell command-line obfuscation methods commonly utilized by the Invoke-Obfuscation framework to bypass security monitoring.

Adversaries utilize PowerShell's Set-MpPreference cmdlet to disable Windows Defender security features and modify threat handling behavior, facilitating persistence and stealth.

Adversaries frequently use PowerShell to interface with WMI objects and delete Volume Shadow Copies, a technique commonly associated with ransomware to prevent system recovery.

Adversaries leverage the Disable-WindowsOptionalFeature PowerShell cmdlet to disable security features like Windows Defender, facilitating defense impairment and persistence.

Adversaries utilize PowerShell commands to move malicious DLLs into protected Windows system directories, a technique commonly associated with persistence and credential access.