Description
Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.
Access to specific areas of the Registry depends on account permissions, with some keys requiring administrator-level access. The built-in Windows command-line utility Reg may be used for local or remote Registry modification.(Citation: Microsoft Reg) Other tools, such as remote access tools, may also contain functionality to interact with the Registry through the Windows API.
The Registry may be modified in order to hide configuration information or malicious payloads via Obfuscated Files or Information.(Citation: Unit42 BabyShark Feb 2019)(Citation: Avaddon Ransomware 2021)(Citation: Microsoft BlackCat Jun 2022)(Citation: CISA Russian Gov Critical Infra 2018) The Registry may also be modified to impair defenses, such as by enabling macros for all Microsoft Office products, allowing privilege escalation without alerting the user, increasing the maximum number of allowed outbound requests, and/or modifying systems to store plaintext credentials in memory.(Citation: CISA LockBit 2023)(Citation: Unit42 BabyShark Feb 2019)
The Registry of a remote system may be modified to aid in execution of files as part of lateral movement. It requires the remote Registry service to be running on the target system.(Citation: Microsoft Remote) Often Valid Accounts are required, along with access to the remote system's SMB/Windows Admin Shares for RPC communication.
Finally, Registry modifications may also include actions to hide keys, such as prepending key names with a null character, which will cause an error and/or be ignored when read via Reg or other utilities using the Win32 API.(Citation: Microsoft Reghide NOV 2006) Adversaries may abuse these pseudo-hidden keys to conceal payloads/commands used to maintain persistence.(Citation: TrendMicro POWELIKS AUG 2014)(Citation: SpectorOps Hiding Reg Jul 2017)
Platforms
Mitigations (1)
Restrict Registry PermissionsM1024
Ensure proper permissions are set for Registry hives to prevent users from modifying keys for system components that may lead to privilege escalation.
Threat Groups (29)
| ID | Group | Context |
|---|---|---|
| G0082 | APT38 | [APT38](https://attack.mitre.org/groups/G0082) uses a tool called CLEANTOAD that has the capability to modify Registry keys.(Citation: FireEye APT38 O... |
| G0119 | Indrik Spider | [Indrik Spider](https://attack.mitre.org/groups/G0119) has modified registry keys to prepare for ransomware execution and to disable common administra... |
| G1043 | BlackByte | [BlackByte](https://attack.mitre.org/groups/G1043) performed Registry modifications to escalate privileges and disable security tools.(Citation: Picus... |
| G0094 | Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) has modified Registry settings for default file associations to enable all macros and for persistence... |
| G1017 | Volt Typhoon | [Volt Typhoon](https://attack.mitre.org/groups/G1017) has used `netsh` to create a PortProxy Registry modification on a compromised server running th... |
| G0040 | Patchwork | A [Patchwork](https://attack.mitre.org/groups/G0040) payload deletes Resiliency Registry keys created by Microsoft Office applications in an apparent ... |
| G0096 | APT41 | [APT41](https://attack.mitre.org/groups/G0096) used a malware variant called GOODLUCK to modify the registry in order to steal credentials.(Citation: ... |
| G0035 | Dragonfly | [Dragonfly](https://attack.mitre.org/groups/G0035) has modified the Registry to perform multiple techniques through the use of [Reg](https://attack.mi... |
| G0078 | Gorgon Group | [Gorgon Group](https://attack.mitre.org/groups/G0078) malware can deactivate security mechanisms in Microsoft Office by editing several keys and value... |
| G0050 | APT32 | [APT32](https://attack.mitre.org/groups/G0050)'s backdoor has modified the Windows Registry to store the backdoor's configuration. (Citation: ESET Oce... |
| G0047 | Gamaredon Group | [Gamaredon Group](https://attack.mitre.org/groups/G0047) has removed security settings for VBA macro execution by changing registry values <code>HKCU\... |
| G0049 | OilRig | [OilRig](https://attack.mitre.org/groups/G0049) has used reg.exe to modify system configuration.(Citation: Symantec Crambus OCT 2023)(Citation: Trend ... |
| G0143 | Aquatic Panda | [Aquatic Panda](https://attack.mitre.org/groups/G0143) modified the victim registry to enable the `RestrictedAdmin` mode feature, allowing for pass th... |
| G1031 | Saint Bear | [Saint Bear](https://attack.mitre.org/groups/G1031) will leverage malicious Windows batch scripts to modify registry values associated with Windows De... |
| G0108 | Blue Mockingbird | [Blue Mockingbird](https://attack.mitre.org/groups/G0108) has used Windows Registry modifications to specify a DLL payload.(Citation: RedCanary Mockin... |
| G0010 | Turla | [Turla](https://attack.mitre.org/groups/G0010) has modified Registry values to store payloads.(Citation: ESET Turla PowerShell May 2019)(Citation: Sym... |
| G0092 | TA505 | [TA505](https://attack.mitre.org/groups/G0092) has used malware to disable Windows Defender through modification of the Registry.(Citation: Korean FSI... |
| G0030 | Lotus Blossom | [Lotus Blossom](https://attack.mitre.org/groups/G0030) has installed tools such as [Sagerunex](https://attack.mitre.org/software/S1210) by writing the... |
| G1051 | Medusa Group | [Medusa Group](https://attack.mitre.org/groups/G1051) has modified Registry keys to elevate privileges, maintain persistence and allow remote access.(... |
| G1003 | Ember Bear | [Ember Bear](https://attack.mitre.org/groups/G1003) modifies registry values for anti-forensics and defense evasion purposes.(Citation: Cadet Blizzard... |
Associated Software (139)
| ID | Name | Type | Context |
|---|---|---|---|
| S0266 | TrickBot | Malware | [TrickBot](https://attack.mitre.org/software/S0266) can modify registry entries.(Citation: Trend Micro Trickbot Nov 2018) |
| S0662 | RCSession | Malware | [RCSession](https://attack.mitre.org/software/S0662) can write its configuration file to the Registry.(Citation: Trend Micro DRBControl February 2020)... |
| S0242 | SynAck | Malware | [SynAck](https://attack.mitre.org/software/S0242) can manipulate Registry keys.(Citation: SecureList SynAck Doppelgänging May 2018) |
| S0343 | Exaramel for Windows | Malware | [Exaramel for Windows](https://attack.mitre.org/software/S0343) adds the configuration to the Registry in XML format.(Citation: ESET TeleBots Oct 2018... |
| S1025 | Amadey | Malware | [Amadey](https://attack.mitre.org/software/S1025) has overwritten registry keys for persistence.(Citation: BlackBerry Amadey 2020) |
| S0229 | Orz | Malware | [Orz](https://attack.mitre.org/software/S0229) can perform Registry operations.(Citation: Proofpoint Leviathan Oct 2017) |
| S0603 | Stuxnet | Malware | [Stuxnet](https://attack.mitre.org/software/S0603) can create registry keys to load driver files.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chie... |
| S0271 | KEYMARBLE | Malware | [KEYMARBLE](https://attack.mitre.org/software/S0271) has a command to create Registry entries for storing data under <code>HKEY_CURRENT_USER\SOFTWARE\... |
| S0386 | Ursnif | Malware | [Ursnif](https://attack.mitre.org/software/S0386) has used Registry modifications as part of its installation routine.(Citation: TrendMicro BKDR_URSNI... |
| S0665 | ThreatNeedle | Malware | [ThreatNeedle](https://attack.mitre.org/software/S0665) can modify the Registry to save its configuration data as the following RC4-encrypted Registry... |
| S0330 | Zeus Panda | Malware | [Zeus Panda](https://attack.mitre.org/software/S0330) modifies several Registry keys under <code>HKCU\Software\Microsoft\Internet Explorer\ PhishingFi... |
| S1058 | Prestige | Malware | [Prestige](https://attack.mitre.org/software/S1058) has the ability to register new registry keys for a new extension handler via `HKCR\.enc` and `HKC... |
| S0239 | Bankshot | Malware | [Bankshot](https://attack.mitre.org/software/S0239) writes data into the Registry key <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Pniumj</code>.(Citat... |
| S0254 | PLAINTEE | Malware | [PLAINTEE](https://attack.mitre.org/software/S0254) uses <code>reg add</code> to add a Registry Run key for persistence.(Citation: Rancor Unit42 June ... |
| S0198 | NETWIRE | Malware | [NETWIRE](https://attack.mitre.org/software/S0198) can modify the Registry to store its configuration information.(Citation: Red Canary NETWIRE Januar... |
| S0668 | TinyTurla | Malware | [TinyTurla](https://attack.mitre.org/software/S0668) can set its configuration parameters in the Registry.(Citation: Talos TinyTurla September 2021) |
| S1226 | BOOKWORM | Malware | [BOOKWORM](https://attack.mitre.org/software/S1226) has modified Registry key values as part of its created service `DeviceSync`. (Citation: Unit42 Bo... |
| S0537 | HyperStack | Malware | [HyperStack](https://attack.mitre.org/software/S0537) can add the name of its communication pipe to <code>HKLM\SYSTEM\\CurrentControlSet\\Services\\la... |
| S0342 | GreyEnergy | Malware | [GreyEnergy](https://attack.mitre.org/software/S0342) modifies conditions in the Registry and adds keys.(Citation: ESET GreyEnergy Oct 2018) |
| S0115 | Crimson | Malware | [Crimson](https://attack.mitre.org/software/S0115) can set a Registry key to determine how long it has been installed and possibly to indicate the ver... |
References
- CISA. (2018, March 16). Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved March 24, 2025.
- CISA. (2023, March 16). #StopRansomware: LockBit 3.0. Retrieved March 24, 2025.
- Javier Yuste and Sergio Pastrana. (2021). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved March 24, 2025.
- Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.
- Microsoft. (2012, April 17). Reg. Retrieved May 1, 2015.
- Microsoft. (n.d.). Enable the Remote Registry Service. Retrieved May 1, 2015.
- Reitz, B. (2017, July 14). Hiding Registry keys with PSReflect. Retrieved August 9, 2018.
- Russinovich, M. & Sharkey, K. (2006, January 10). Reghide. Retrieved August 9, 2018.
- Santos, R. (2014, August 1). POWELIKS: Malware Hides In Windows Registry. Retrieved August 9, 2018.
- Unit 42. (2019, February 22). New BabyShark Malware Targets U.S. National Security Think Tanks. Retrieved October 7, 2019.
Frequently Asked Questions
What is T1112 (Modify Registry)?
T1112 is a MITRE ATT&CK technique named 'Modify Registry'. It belongs to the Defense Impairment, Persistence tactic(s). Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution. Access to specific areas of the Registry depends on...
How can T1112 be detected?
Detection of T1112 (Modify Registry) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1112?
There are 1 documented mitigations for T1112. Key mitigations include: Restrict Registry Permissions.
Which threat groups use T1112?
Known threat groups using T1112 include: APT38, Indrik Spider, BlackByte, Kimsuky, Volt Typhoon, Patchwork, APT41, Dragonfly.