Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Defense Evasion/ T1112

T1112Modify Registry

T1112 — Modify Registry is a MITRE ATT&CK technique in the Defense Evasion tactic. Clankerusecase tracks 85 detection use cases covering it and 7 threat-intel articles citing it.

Defense EvasionPersistence
View on the matrix → Filter Detection Library MITRE official spec ↗
85Use cases
7Articles
0Sub-techniques
2Tactics

Use cases covering this technique (85)

Disable Registry Tool ESCU actions · alerting P Disable Security Logs Using MiniNt Registry ESCU actions · alerting P Disable Show Hidden Files ESCU actions · hunting P Disable Windows App Hotkeys ESCU actions · alerting P Disabling CMD Application ESCU actions · alerting P Disabling ControlPanel ESCU actions · alerting P Disabling NoRun Windows App ESCU actions · alerting P Enable WDigest UseLogonCredential Registry ESCU actions · alerting P FodHelper UAC Bypass ESCU actions · alerting P Malicious InProcServer32 Modification ESCU actions · alerting P Remcos client registry install entry ESCU actions · alerting P Revil Registry Entry ESCU actions · alerting P Rundll32 Shimcache Flush ESCU actions · alerting P Suspicious Reg exe Process ESCU actions · hunting P Windows Anomalous Registry Value Length in Environment Key ESCU actions · hunting P Windows Defender ASR Registry Modification ESCU actions · hunting P Windows Defender ASR Rule Disabled ESCU actions · alerting P Windows Deleted Registry By A Non Critical Process File Path ESCU actions · hunting P Windows Disable Change Password Through Registry ESCU actions · hunting P Windows Disable Lock Workstation Feature Through Registry ESCU actions · hunting P Windows Disable LogOff Button Through Registry ESCU actions · hunting P Windows Disable Notification Center ESCU actions · hunting P Windows Disable Shutdown Button Through Registry ESCU actions · hunting P Windows Disable Windows Group Policy Features Through Registry ESCU actions · hunting P Windows Downdate Registry Activity ESCU actions · hunting P Windows Hide Notification Features Through Registry ESCU actions · hunting P Windows Impair Defenses Disable AV AutoStart via Registry ESCU actions · alerting P Windows InProcServer32 New Outlook Form ESCU actions · hunting P Windows Modify Registry AuthenticationLevelOverride ESCU actions · hunting P Windows Modify Registry Auto Minor Updates ESCU actions · hunting P Windows Modify Registry Auto Update Notif ESCU actions · hunting P Windows Modify Registry Configure BitLocker ESCU actions · alerting P Windows Modify Registry Default Icon Setting ESCU actions · hunting P Windows Modify Registry Delete Firewall Rules ESCU actions · alerting P Windows Modify Registry Disable RDP ESCU actions · hunting P Windows Modify Registry Disable Restricted Admin ESCU actions · alerting P Windows Modify Registry Disable Toast Notifications ESCU actions · hunting P Windows Modify Registry Disable Win Defender Raw Write Notif ESCU actions · hunting P Windows Modify Registry Disable WinDefender Notifications ESCU actions · alerting P Windows Modify Registry Disable Windows Security Center Notif ESCU actions · hunting P Windows Modify Registry DisableRemoteDesktopAntiAlias ESCU actions · alerting P Windows Modify Registry DisableSecuritySettings ESCU actions · alerting P Windows Modify Registry Disabling WER Settings ESCU actions · alerting P Windows Modify Registry DisAllow Windows App ESCU actions · alerting P Windows Modify Registry Do Not Connect To Win Update ESCU actions · hunting P Windows Modify Registry DontShowUI ESCU actions · alerting P Windows Modify Registry EnableLinkedConnections ESCU actions · alerting P Windows Modify Registry LongPathsEnabled ESCU actions · hunting P Windows Modify Registry MaxConnectionPerServer ESCU actions · hunting P Windows Modify Registry No Auto Reboot With Logon User ESCU actions · hunting P Windows Modify Registry No Auto Update ESCU actions · hunting P Windows Modify Registry NoChangingWallPaper ESCU actions · alerting P Windows Modify Registry on Smart Card Group Policy ESCU actions · hunting P Windows Modify Registry ProxyEnable ESCU actions · hunting P Windows Modify Registry ProxyServer ESCU actions · hunting P Windows Modify Registry Qakbot Binary Data Registry ESCU actions · hunting P Windows Modify Registry Regedit Silent Reg Import ESCU actions · hunting P Windows Modify Registry Risk Behavior ESCU actions · alerting P Windows Modify Registry Suppress Win Defender Notif ESCU actions · hunting P Windows Modify Registry Tamper Protection ESCU actions · alerting P Windows Modify Registry to Add or Modify Firewall Rule ESCU actions · hunting P Windows Modify Registry UpdateServiceUrlAlternate ESCU actions · hunting P Windows Modify Registry USeWuServer ESCU actions · hunting P Windows Modify Registry Utilize ProgIDs ESCU actions · hunting P Windows Modify Registry ValleyRAT C2 Config ESCU actions · alerting P Windows Modify Registry ValleyRat PWN Reg Entry ESCU actions · alerting P Windows Modify Registry With MD5 Reg Key Name ESCU actions · alerting P Windows Modify Registry WuServer ESCU actions · hunting P Windows Modify Registry wuStatusServer ESCU actions · hunting P Windows Modify Show Compress Color And Info Tip Registry ESCU actions · alerting P Windows New InProcServer32 Added ESCU actions · hunting P Windows Outlook Dialogs Disabled from Unusual Process ESCU actions · alerting P Windows Outlook LoadMacroProviderOnBoot Persistence ESCU actions · alerting P Windows Outlook WebView Registry Modification ESCU actions · hunting P Windows Routing and Remote Access Service Registry Key Change ESCU actions · hunting P Windows RunMRU Registry Key or Value Deleted ESCU actions · hunting P Windows Set Network Profile Category to Private via Registry ESCU actions · hunting P Windows Snake Malware Registry Modification wav OpenWithProgIds ESCU actions · alerting P Windows SnappyBee Create Test Registry ESCU actions · alerting P Windows Set Private Network Profile via Registry ESCU actions · hunting P [LLM] 'PDF Viewer' extension sideloaded into browser profile by non-browser process Bespoke install · hunting DSΣPDDCS [LLM] RunMRU registry write launching mshta / URL / PowerShell (ClickFix-style user persistence) Bespoke install · alerting DSΣPDD [LLM] RDP re-enable + EDR/Defender disable batch script (LockBit intrusion) Bespoke install · alerting DSΣPDDCS [LLM] ValleyRAT registry-resident shellcode (HKCU\Console\0|1) and MyPythonApp Run-key persistence Bespoke install · hunting DSΣP [LLM] MuddyViper persistence via ManageOnDriveUpdater scheduled task or Startup folder hijack Bespoke install · alerting DSPDDCS

Articles citing this technique (7)

crit China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud art-49
crit 128 Seconds to disruption: Microsoft Defender stops ransomware at QNET art-124
crit An analysis of incidents at Brazilian educational institutions art-146
crit Webworm: New burrowing techniques art-459
crit A rigged game: ScarCruft compromises gaming platform in a supply-chain attack art-500
high A cunning predator: How Silver Fox preys on Japanese firms this tax season art-589
med MuddyWater: Snakes by the riverbank art-786