Windows-Registry

Attackers, particularly ransomware operators, modify Windows Registry keys to disable critical system features and security configurations, hindering forensic response and maintaining persistence.

Malware families, including Remote Access Trojans (RATs), modify Windows registry keys to disable the Notification Center, effectively suppressing system alerts to hide malicious activity.

Threat actors and ransomware operators modify the Windows Registry to disable the workstation lock feature, ensuring persistent access and preventing user interference during malicious operations.

Adversaries modify the WDigest UseLogonCredential registry key to downgrade credential protection and enable the storage of clear-text passwords in memory for exfiltration via LSASS.

Adversaries often achieve persistence by registering malicious Windows services with binaries located in writeable or temp directories to evade detection.

Attackers can disable .NET Framework Event Tracing for Windows (ETW) by modifying registry environment variables, effectively blinding EDR solutions and security telemetry to malicious managed-code execution.

An attacker disables Windows Defender's signature retirement feature by modifying a registry key, potentially reducing its effectiveness in detecting threats by allowing older, less relevant signatures to persist.

This analytic detects modifications to the Windows registry to disable Windows Defender Network Protection, potentially leaving the system vulnerable to network-based threats.

Detection of modifications to the Windows registry that change the Windows Defender Quick Scan Interval, potentially impairing its ability to detect malware promptly.