Registry

Detects potentially suspicious changes to the SentinelOne context menu scan command by a process other than SentinelOne.

This detection targets unauthorized modifications to Windows Security Center registry keys used by threat actors to spoof or disable antivirus product reporting.

Adversaries modify specific registry keys to disable Microsoft Defender Firewall exceptions, potentially enabling unauthorized lateral movement or command-and-control communication.

Attackers achieve persistence and privilege escalation by modifying the Print Monitors registry key to force the system to load an arbitrary malicious DLL under SYSTEM privileges.

Snake malware modifies the .wav\OpenWithProgIds registry path to facilitate the decryption of configuration blobs used by WerFault.exe to load malicious kernel drivers.

Adversaries, including those deploying Lumma Stealer via fake CAPTCHA campaigns, utilize the Windows RunMRU registry key to execute malicious commands while masking activity as legitimate user behavior.

This brief outlines the detection of unauthorized root CA certificate installation in the Windows Registry, a technique used to facilitate man-in-the-middle attacks and bypass encrypted communication security.

Attackers may modify Outlook registry keys related to WebView and Today features to redirect web-based components to malicious URLs, facilitating phishing and credential theft.

Attackers are modifying the 'CustomSD' registry value in Windows EventLog channels to restrict access to logs and blind security monitoring capabilities.

Detection of Hermetic Wiper malware activities involving the manipulation of Windows registry keys 'ShowCompColor' and 'ShowInfoTip' to alter file visibility and UI elements.

Adversaries, including those using Azorult malware, modify the 'Notification_Suppress' registry key to disable Windows Defender alerts and facilitate stealthy persistence.

Adversaries and malware, including DarkGate, modify the Windows registry key 'ProxyEnable' to redirect network traffic through a proxy for C2 communication and data exfiltration.

The ShrinkLocker ransomware family modifies the 'scforceoption' registry key to enforce mandatory smart card authentication, disrupting standard system access and manipulating security protocols.

The Warzone RAT malware modifies Windows registry keys related to connection limits to facilitate lateral movement and network-based attacks.

Detection of unauthorized modifications to the EnableLinkedConnections registry key, a technique used by BlackByte ransomware to enable cross-privilege network share access.

Attackers, including the Azorult malware group, modify the Windows 'DisallowRun' registry key to prevent security tools from executing, thereby facilitating evasion and persistence.

Adversaries modify Windows Registry keys to disable Windows Error Reporting (WER) to suppress diagnostic notifications, thereby concealing malicious activity and reducing the likelihood of detection.

Adversaries, including RedLine Stealer, modify registry keys to disable Windows Defender notifications, allowing malicious activity to proceed without alerting the user or security teams.

Adversaries, including operators of the Azorult malware, modify the Windows Registry to disable toast notifications, preventing users from receiving critical system security updates.

Adversaries, including the operators of RedLine Stealer, modify the Windows Registry to set Windows Update notification preferences to 'Notify before download' to evade security patches.

Adversaries manipulate Windows WMI AutoLogger registry keys to disable logging providers and telemetry, facilitating defense evasion and persistence on compromised systems.

Attackers utilize the Image File Execution Options (IFEO) registry key to intercept process execution and achieve persistence or evasion by attaching a debugger to legitimate Windows binaries.

Adversaries, specifically ransomware operators, modify Windows Registry keys to disable the logoff button, hindering incident response and forcing session persistence.

Adversaries can abuse the Windows Application Compatibility Shim (AppCompatFlags) mechanism by modifying specific registry keys to achieve persistence, escalate privileges, or bypass security controls.

Detection of the UseLogonCredential registry modification used to enable plaintext credential storage in Windows memory for post-exploitation credential dumping.

Attackers modify registry keys to disable Event Tracing for Windows (ETW), effectively blinding security telemetry and facilitating defense evasion.

Adversaries may abuse compromised or legitimate SolarWinds binaries to disable security services by modifying Windows Registry 'Start' values, a technique used for defense evasion.

Adversaries may hide malicious software such as remote-access tools from the Windows Programs and Features list by executing the HideUL utility or modifying the SystemComponent registry value.

Detection of unauthorized modifications to Windows registry autostart keys, a common technique used by threat actors to maintain persistence across system reboots.

Adversaries can gain persistence and perform proxy execution by modifying the WSL InstallLocation registry key to redirect binary execution to malicious payloads.

Detection of adversaries modifying the UserInitMprLogonScript registry value to establish persistence via logon scripts.

Adversaries abuse the Image File Execution Options (IFEO) registry keys to establish persistence or intercept process termination by configuring GlobalFlags and SilentProcessExit mechanisms.

Detects unauthorized modification of Windows Registry keys within CurrentControlSet used for persistent execution via system extensibility points.

Adversaries, including the DarkGate malware operators, modify sensitive registry keys associated with Terminal Services to facilitate session hijacking, unauthorized remote access, and defense impairment.

Detects unauthorized modifications to Microsoft Outlook security-related registry keys that may be used to weaken email protections or establish persistence.

Adversaries may achieve persistence by registering a malicious DLL within the Windows Time service (W32Time) configuration, allowing for arbitrary code execution upon system boot.

Adversaries frequently disable Windows Defender security features by modifying specific registry keys to impair endpoint detection and response capabilities.

Adversaries can achieve persistence by modifying the AutodialDLL registry key to load a malicious DLL through the Windows Winsock2 library.

Detection of registry modifications targeting Autostart Extensibility Points within the Wow6432Node hive, a common technique for achieving persistence on Windows systems.

Detection of unauthorized modifications to Windows registry keys that enable persistence through autostart extensibility points within the NT CurrentVersion hive.

Adversaries can achieve persistence and privilege escalation by modifying the Winlogon Notify registry key to trigger the execution of arbitrary DLLs during user login.

Detection of attackers suppressing Windows User Account Control (UAC) prompts by modifying the UACDisableNotify registry value to facilitate unauthorized system changes.

Adversaries, including the Agent Tesla malware, modify Windows Registry keys under Explorer Policies to impair user access to system tools and desktop functionality.

Adversaries can achieve persistence and privilege escalation by installing malicious shim databases to intercept and redirect application execution.

Adversaries may achieve persistence or privilege escalation by hijacking COM object registrations associated with scrobj.dll to execute arbitrary scriptlet code.

Adversaries can achieve persistence and code execution by modifying the Outlook WebView registry keys to point to a malicious URL.

An adversary can achieve persistence or defense impairment by modifying Windows registry keys to redirect Event Viewer's 'Events.asp' link handling to a malicious binary or command line.

Adversaries modify registry keys to disable Microsoft Office Protected View security controls, facilitating the execution of malicious documents.

Adversaries can install malicious root or CA certificates into the Windows registry to facilitate traffic interception, bypass security controls, and establish persistence.

Malicious actors, including those behind Agent Tesla and Hermetic Wiper, utilize specific registry modifications to hide system interface elements from users as a defensive impairment technique.

Adversaries frequently modify Windows registry keys to prevent users from viewing hidden and system files, a technique used to maintain persistence and camouflage malicious artifacts.

Adversaries modify Windows registry keys to hide file extensions and system files, facilitating the masquerading of malicious executables.

An adversary or administrator can modify the DisallowRun registry key to prevent specific applications from executing, a technique often used to impair security tools or enforce restrictive environment configurations.

Adversaries disable the Windows Firewall by modifying specific registry keys to bypass network security controls and facilitate lateral movement or data exfiltration.

Attackers may modify registry-based Security Descriptor Definition Language (SDDL) strings for Windows Event Log channels to impair defensive monitoring by restricting access to log data.

This brief documents detection logic for monitoring unauthorized modifications to Windows Session Manager registry keys, which are often leveraged by attackers for persistence and privilege escalation.

Adversaries frequently modify Windows Autostart Extensibility Point (ASEP) registry keys to establish persistence, requiring robust monitoring of registry set events.

Adversaries manipulate the ServiceDLL registry value within Windows service configurations to achieve persistence by forcing the loading of unauthorized malicious dynamic link libraries.

Adversaries manipulate Windows shell open command registry keys to facilitate User Account Control (UAC) bypass and establish persistence through file association hijacking.

Adversaries modify Windows LegalNotice registry values to display custom ransom messages during the login process as part of an extortion campaign.

Adversaries, including operators of Agent Tesla and Batloader, modify Windows Registry keys to disable system administration tools and security features, hindering incident response and persistence.

Adversaries are modifying the PYTHONPATH environment variable during Python package installation to redirect module imports, enabling code execution and persistence whenever Python is invoked.

This brief outlines a detection strategy for identifying modifications to Windows registry keys commonly used for persistence, including Run, Winlogon, and Image File Execution Options, enabling detection engineers to alert on unauthorized system startup entries for malicious code execution to prevent persistent access.

This brief details a detection strategy for identifying the use of renamed Sysinternals utilities by monitoring for suspicious modifications to the 'EulaAccepted' registry key, indicating potential post-exploitation activity or defense evasion on Windows systems.

This brief details a detection method for adversaries using renamed Sysinternals tools, a legitimate suite of utilities, to evade endpoint detection by triggering the `EulaAccepted` registry key creation, potentially leading to unauthorized system manipulation or data access on Windows systems.

This analytic identifies instances where three or more distinct registry modification events associated with MITRE ATT&CK Technique T1112 are detected, leveraging Splunk's Risk data model to detect persistence, hiding malicious configurations, or erasing forensic evidence.

The rule identifies the use of Windows Management Instrumentation StdRegProv (registry provider) to modify commonly abused registry locations for persistence by detecting registry changes made by WmiPrvSe.exe in specific registry paths.

This rule detects a persistence mechanism that utilizes the NtSetValueKey native API to create a hidden (null terminated) registry key, evading detection from system utilities.

Detection of suspicious ImagePath values written to the registry, indicating potential persistence or privilege escalation via abnormal service creation involving command interpreters or named pipes.

Detects suspicious modifications to the Windows Startup shell folder, a technique used to bypass detections monitoring file creation in the Windows Startup folder.

RegPwnBOF exploits a registry symlink race condition in the Windows Accessibility ATConfig mechanism, enabling a normal user to write arbitrary values to protected HKLM registry keys for persistence and privilege escalation.

Attackers abuse the Outlook Home Page functionality by modifying specific registry keys to point to attacker-controlled URLs or file paths, enabling command and control or persistence on compromised Windows systems.

This brief covers the modification of Subject Interface Package (SIP) providers on Windows systems, a technique used by attackers to bypass signature validation checks and inject malicious code into critical processes, ultimately leading to defense evasion.

Adversaries can modify Outlook Home Page registry settings to inject malicious content, enabling command and control or persistence, detected by monitoring specific registry keys for unusual URL or path values.

Attackers may abuse the Netsh Helper DLL functionality by adding malicious DLLs to execute payloads every time the netsh utility is executed via administrators or scheduled tasks, achieving persistence.

Attackers may establish persistence by adding a malicious DLL as a Netsh Helper, which executes whenever the Netsh utility is run, often abusing this mechanism to execute malicious payloads.

Adversaries modify the AmsiEnable registry key to 0 to disable Windows Script AMSI scanning, bypassing AMSI protections for Windows Script Host or JScript execution.

Attackers modify the Microsoft Office 'Office Test' Registry key to achieve persistence by specifying a malicious DLL that executes upon application startup.

An attacker might attempt to disable Windows Defender Antivirus by modifying specific registry keys, potentially leading to a system vulnerable to malware and other threats.

Attackers modify the Windows registry to weaken NTLM authentication, forcing a downgrade to the less secure NTLMv1 protocol, potentially leading to credential compromise.

Attackers can achieve persistence by modifying the ReflectDebugger registry key associated with Windows Error Reporting (Werfault) to execute arbitrary code when Werfault is invoked with the `-pr` parameter.

Attackers modify Windows Registry keys to disable Windows Defender real-time behavior monitoring, a tactic used by malware to evade detection and persist on compromised systems.

Detection of unauthorized or suspicious wallpaper modifications on endpoints can indicate malicious activity or policy violations.

Adversaries may modify the Windows services registry keys directly to stealthily persist through abnormal service creation or modification of an existing service, bypassing standard APIs, detected by monitoring registry changes related to service DLLs and image paths.

Attackers may disable Protected Process Light (PPL) protection for the LSASS process by modifying specific registry keys, allowing for credential dumping and other malicious activities.

Attackers may disable PowerShell Script Block Logging by modifying the registry to conceal their activities on the host and evade detection by setting the `EnableScriptBlockLogging` registry value to 0, impacting security monitoring and incident response capabilities.

Attackers may disable Event Tracing for Windows (ETW) for the .NET Framework by modifying the ETWEnabled registry value, allowing them to evade endpoint detection and response (EDR) tools and hide malicious activity.

Attackers use PowerShell to query the Windows registry's Uninstall key to discover installed software and identify potential vulnerabilities for exploitation.

This analytic detects suspicious modifications to the EventLog security descriptor registry value, specifically the 'CustomSD' value, within the registry path 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\<Channel>\CustomSD', which can be used for defense evasion by attackers.

An attacker modifies the Windows Defender ThrottleDetectionEventsRate registry setting to reduce the frequency of logged detection events, potentially evading detection.

An attacker modifies the Windows Defender ThreatSeverityDefaultAction registry setting to weaken defenses, potentially leading to unaddressed threats and system compromise.

Attackers modify the Windows registry to disable Windows Defender generic reports, preventing error reports and potentially hiding malicious activity.

Adversaries modify Windows Defender exclusion registry entries to bypass antivirus and execute malicious code undetected, potentially leading to persistence and further malicious activities.

This rule detects changes to uncommon registry persistence keys on Windows systems that are not commonly used or modified by legitimate programs, which could indicate an adversary's attempt to persist in a stealthy manner by modifying registry keys for persistence, ensuring malicious code executes on startup or during specific events.

Detection of processes attempting to access the Windows registry to recover product keys, potentially indicating malware activity, unauthorized security bypass, or data exfiltration.

Attackers modify registry run keys or startup keys to achieve persistence by referencing a program that executes when a user logs in or the system boots.

Modification of the AppInit DLLs registry keys on Windows systems allows attackers to execute code in every process that loads user32.dll, establishing persistence and potentially escalating privileges.

An attacker disables the Microsoft Defender 'Block at First Seen' feature to allow potentially malicious files to execute without initial scrutiny, increasing the risk of malware infection and data compromise.

This rule detects registry write modifications hiding encoded portable executables, indicative of adversary defense evasion by avoiding storing malicious content directly on disk.

Adversaries may modify the RunAsPPL registry key to disable LSA protection, which prevents nonprotected processes from reading memory and injecting code, potentially leading to credential access.

Adversaries may establish persistence by executing malicious content triggered by hijacked references to COM objects through Component Object Model (COM) hijacking via registry modification on Windows systems.

This analytic detects modifications to the Windows registry, specifically targeting the `ServiceKeepAlive` value, to impair Windows Defender's ability to perform timely health checks, potentially leading to a vulnerable system state.

Adversaries may establish persistence by modifying the Windows Security Support Provider (SSP) configuration in the registry, allowing malicious code to load during system startup.

Attackers can establish persistence and evade defenses by modifying the Debugger and SilentProcessExit registry keys to perform Image File Execution Options (IFEO) injection, allowing them to intercept file executions and run malicious code.

Adversaries achieve persistence by creating hidden, null-terminated registry keys within common Run key locations, evading standard system utilities.

Attackers may modify Microsoft Office registry settings related to macro security (AccessVBOM, VbaWarnings) to disable security warnings, enabling malicious macros for persistence and further compromise.

Detection of the enabling of full user-mode dumps system-wide, a setting change leveraged in LSASS Shtinkering attacks to dump LSASS process memory and steal credentials.

Adversaries abuse Image File Execution Options (IFEO) in the Windows Registry by modifying Debugger or MonitorProcess keys to intercept legitimate file executions, enabling persistence and defense evasion.