Skip to content
Threat Feed
Subscribe

Tag

Registry_modification

5 briefs RSS
high advisory

Windows Defender SpyNet Reporting Disabled via Registry Modification

Attackers disable Windows Defender SpyNet reporting by modifying specific registry keys, preventing telemetry data from being sent and allowing malicious activities to go undetected.

Splunk Enterprise +3 windows registry_modification defender_evasion
2r
medium advisory

Outlook Security Settings Registry Modification

Attackers modify Outlook security settings via registry changes to enable malicious mail rules and bypass security controls, potentially leading to persistence and data compromise.

Microsoft Outlook persistence registry_modification outlook email
2r 1t
high threat

Windows Defender BlockAtFirstSeen Feature Disabled via Registry Modification

An attacker modifies the Windows Registry to disable the Windows Defender BlockAtFirstSeen feature, potentially allowing malware to bypass initial detection and increasing the risk of system compromise.

exploited Windows Defender +3 registry_modification defender blockatfirstseen
2r
low advisory

Werfault ReflectDebugger Persistence via Registry Modification

Attackers may establish persistence by modifying the ReflectDebugger registry key associated with Windows Error Reporting to execute arbitrary code when Werfault is invoked with the '-pr' parameter.

Elastic Defend +1 persistence registry_modification werfault
2r 2t
high advisory

Outlook Dialogs Disabled by Unusual Process

The detection identifies the modification of the Windows Registry key 'PONT_STRING' under Outlook Options by a process other than Outlook.exe, potentially indicating malware activity such as NotDoor.

Outlook +3 registry_modification malware notdoor
2r 1t