ATT&CK coverage › Technique
Modify Registry T1112
Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.
Events covered
9 catalog events are tagged with this technique by at least one rule.
Authoring guide
Patterns shared across the 149 rules above: which fields they filter on, what specific values they look for, and what they exclude. Field names are normalized across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.
Fields filtered most (22 distinct)
The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.
Top indicator values (552 distinct)
Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique.
Common exclusions (3 distinct)
Field/operator/value combinations that rules under this technique routinely exclude (top-level not() clauses). These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths.
Rules under this technique
Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.
Sigma 77 rules
- Activate Suppression of Windows Security Center Notifications
- Add DisallowRun Execution to Registry
- Allow RDP Remote Assistance Feature
- Change the Fax Dll
- Change User Account Associated with the FAX Service
- ClickOnce Trust Prompt Tampering
- CrashControl CrashDump Disabled
- DHCP Callout DLL Installation
- Disable Internal Tools or Feature in Registry
- Disable Security Events Logging Adding Reg Key MiniNt
- Disable Windows Security Center Notifications
- DNS-over-HTTPS Enabled by Registry
- Enable LM Hash Storage
- Enable LM Hash Storage - ProcCreation
- ETW Logging Disabled For rpcrt4.dll
- ETW Logging Disabled For SCM
- ETW Logging Disabled In .NET Processes - Registry
- ETW Logging Disabled In .NET Processes - Sysmon Registry
- Imports Registry Key From a File
- Imports Registry Key From an ADS
- Macro Enabled In A Potentially Suspicious Document
- Modification of IE Registry Settings
- NET NGenAssemblyUsageLog Registry Key Tamper
- NetNTLM Downgrade Attack
- NetNTLM Downgrade Attack - Registry
- New BgInfo.EXE Custom DB Path Registry Configuration
- New BgInfo.EXE Custom VBScript Registry Configuration
- New BgInfo.EXE Custom WMI Query Registry Configuration
- New DNS ServerLevelPluginDll Installed
- New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE
- Non-privileged Usage of Reg or Powershell
- Office Macros Warning Disabled
- Outlook EnableUnsafeClientMailRules Setting Enabled - Registry
- Potential Persistence Via Custom Protocol Handler
- Potential Persistence Via Event Viewer Events.asp
- Potential Persistence Via Outlook Home Page
- Potential Persistence Via Outlook Today Page
- Potential Qakbot Registry Activity
- Potential Suspicious Registry File Imported Via Reg.EXE
- Potential Tampering With RDP Related Registry Keys Via Reg.EXE
- Potentially Suspicious Desktop Background Change Using Reg.EXE
- Potentially Suspicious Desktop Background Change Via Registry
- PowerShell Logging Disabled Via Registry Key Tampering
- RDP Sensitive Settings Changed
- RDP Sensitive Settings Changed to Zero
- RedMimicry Winnti Playbook Registry Manipulation
- Reg Add Suspicious Paths
- Registry Entries For Azorult Malware
- Registry Explorer Policy Modification
- Registry Hide Function from User
- Registry Manipulation via WMI Stdregprov
- Registry Modification Attempt Via VBScript
- Registry Modification Attempt Via VBScript - PowerShell
- Registry Modification for OCI DLL Redirection
- Registry Modification of MS-settings Protocol Handler
- Registry Modification Via Regini.EXE
- Registry Tampering by Potentially Suspicious Processes
- Removal of Potential COM Hijacking Registry Keys
- RestrictedAdminMode Registry Value Tampering
- RestrictedAdminMode Registry Value Tampering - ProcCreation
- Run Once Task Configuration in Registry
- Run Once Task Execution as Configured in Registry
- Security Event Logging Disabled via MiniNt Registry Key - Process
- Security Event Logging Disabled via MiniNt Registry Key - Registry Set
- Service Binary in Suspicious Folder
- ShimCache Flush
- Suspicious Registry Modification From ADS Via Regini.EXE
- Suspicious VBoxDrvInst.exe Parameters
- Sysmon Channel Reference Deletion
- Terminal Server Client Connection History Cleared - Registry
- Trust Access Disable For VBApplications
- Uncommon Microsoft Office Trusted Location Added
- User Shell Folders Registry Modification via CommandLine
- Wdigest CredGuard Registry Modification
- Wdigest Enable UseLogonCredential
- Windows Event Log Access Tampering Via Registry
- Winlogon AllowMultipleTSSessions Enable
Splunk 72 rules
- Disable Registry Tool
- Disable Security Logs Using MiniNt Registry
- Disable Show Hidden Files
- Disable Windows App Hotkeys
- Disabling CMD Application
- Disabling ControlPanel
- Disabling NoRun Windows App
- Enable WDigest UseLogonCredential Registry
- Malicious InProcServer32 Modification
- Remcos client registry install entry
- Revil Registry Entry
- Windows Defender ASR Registry Modification
- Windows Defender ASR Rule Disabled
- Windows Deleted Registry By A Non Critical Process File Path
- Windows Disable Change Password Through Registry
- Windows Disable Lock Workstation Feature Through Registry
- Windows Disable LogOff Button Through Registry
- Windows Disable Notification Center
- Windows Disable Shutdown Button Through Registry
- Windows Disable Windows Group Policy Features Through Registry
- Windows Hide Notification Features Through Registry
- Windows Impair Defenses Disable AV AutoStart via Registry
- Windows InProcServer32 New Outlook Form
- Windows Modify Registry AuthenticationLevelOverride
- Windows Modify Registry Auto Minor Updates
- Windows Modify Registry Auto Update Notif
- Windows Modify Registry Configure BitLocker
- Windows Modify Registry Default Icon Setting
- Windows Modify Registry Delete Firewall Rules
- Windows Modify Registry Disable RDP
- Windows Modify Registry Disable Restricted Admin
- Windows Modify Registry Disable Toast Notifications
- Windows Modify Registry Disable Win Defender Raw Write Notif
- Windows Modify Registry Disable WinDefender Notifications
- Windows Modify Registry Disable Windows Security Center Notif
- Windows Modify Registry DisableRemoteDesktopAntiAlias
- Windows Modify Registry DisableSecuritySettings
- Windows Modify Registry Disabling WER Settings
- Windows Modify Registry DisAllow Windows App
- Windows Modify Registry Do Not Connect To Win Update
- Windows Modify Registry DontShowUI
- Windows Modify Registry EnableLinkedConnections
- Windows Modify Registry LongPathsEnabled
- Windows Modify Registry MaxConnectionPerServer
- Windows Modify Registry No Auto Reboot With Logon User
- Windows Modify Registry No Auto Update
- Windows Modify Registry NoChangingWallPaper
- Windows Modify Registry on Smart Card Group Policy
- Windows Modify Registry ProxyEnable
- Windows Modify Registry ProxyServer
- Windows Modify Registry Qakbot Binary Data Registry
- Windows Modify Registry Suppress Win Defender Notif
- Windows Modify Registry Tamper Protection
- Windows Modify Registry to Add or Modify Firewall Rule
- Windows Modify Registry UpdateServiceUrlAlternate
- Windows Modify Registry USeWuServer
- Windows Modify Registry Utilize ProgIDs
- Windows Modify Registry ValleyRAT C2 Config
- Windows Modify Registry ValleyRat PWN Reg Entry
- Windows Modify Registry With MD5 Reg Key Name
- Windows Modify Registry WuServer
- Windows Modify Registry wuStatusServer
- Windows Modify Show Compress Color And Info Tip Registry
- Windows New InProcServer32 Added
- Windows Outlook Dialogs Disabled from Unusual Process
- Windows Outlook LoadMacroProviderOnBoot Persistence
- Windows Outlook WebView Registry Modification
- Windows Routing and Remote Access Service Registry Key Change
- Windows RunMRU Registry Key or Value Deleted
- Windows Set Network Profile Category to Private via Registry
- Windows Snake Malware Registry Modification wav OpenWithProgIds
- Windows SnappyBee Create Test Registry