Skip to content
Threat Feed
Subscribe

Tag

Registry-Abuse

11 briefs RSS
medium advisory

Windows Service Creation via Registry Persistence

Detection of unauthorized Windows service configuration via modification of registry ImagePath values, a common technique for persistence, privilege escalation, and lateral movement by various threat actors.

Windows persistence privilege-escalation lateral-movement registry-abuse
1r 1t
high advisory

Detection of Credential Access via Registry Hive Export

Attackers leverage legitimate Windows binaries like reg.exe and regedit.exe to export sensitive SAM, SECURITY, and SYSTEM hives for offline credential theft and lateral movement.

Windows credential-access registry-abuse
1r 1t
high advisory

Windows LSASS Credential Theft via Registry Manipulation

Adversaries manipulate undocumented registry keys under the NTDS service to load malicious DLLs into the Local Security Authority Subsystem Service (LSASS) for credential theft and persistence.

Windows persistence privilege-escalation registry-abuse credential-theft
1r 1t
medium advisory

Detection of Unauthorized System Restore Disablement via Registry

Threat actors, including those deploying Remote Access Trojans such as NjRAT, modify Windows Registry keys to disable System Restore and hinder recovery efforts.

Windows defense-evasion impact registry-abuse rat
1r 1t
medium advisory

Detection of Registry-Based Disabling of Windows Command Prompt

Malware and threat actors modify Windows registry keys to disable the Command Prompt (cmd.exe) as a defense evasion tactic to hinder incident response and system remediation.

Windows defense-evasion registry-abuse incident-response
1r 1t
medium advisory

Detection of Registry Editor Disablement via Registry Modification

Attackers and malware frequently modify the Windows registry to disable the Registry Editor, preventing incident responders from manually removing malicious persistence mechanisms.

Windows defense-evasion registry-abuse persistence
1r 1t
high advisory

Detection of Windows Defender Service Disabling via Registry Modification

This brief covers the detection of adversaries disabling Windows Defender services by modifying specific registry keys to set the 'Start' value to '0x00000004', indicating an attempt to evade detection and maintain persistence.

Windows Defender +3 defense-evasion persistence windows registry-abuse
2r
high advisory

Windows Defender SmartScreen App Install Control Disabled via Registry Modification

Attackers modify the Windows Registry to disable Windows Defender SmartScreen App Install Control, potentially allowing the installation of malicious web-based applications without restrictions, leading to system compromise and sensitive information exposure.

Splunk Enterprise +3 defense-evasion registry-abuse windows
2r
high advisory

Windows Defender Profile Registry Key Deletion

Detection of Windows Defender profile registry key deletion, indicating potential defense evasion by malware or threat actors aiming to disable security controls.

Windows Defender +3 defense-evasion registry-abuse windows
2r 1t
high advisory

Windows Defender Phishing Filter Override via Registry Modification

The analytic detects modifications to the Windows registry that disable the Windows Defender phishing filter, potentially allowing attackers to deceive users into visiting malicious websites without browser warnings.

Microsoft Edge +3 defense-evasion windows registry-abuse
2r 1t
high advisory

Windows AutoLogger Session Disabled via Registry Modification

An attacker disables Windows AutoLogger sessions by modifying specific registry values to evade defenses and blind EDR and log ingest tools.

Splunk Enterprise +3 defense-evasion windows registry-abuse
2r 1t