Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1112: Modify Registry

Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.

Access to specific areas of the Registry depends on account permissions, with some keys requiring administrator-level access. The built-in Windows command-line utility Reg may be used for local or remote Registry modification.[1] Other tools, such as remote access tools, may also contain functionality to interact with the Registry through the Windows API.

The Registry may be modified in order to hide configuration information or malicious payloads via Obfuscated Files or Information.[2][3][4][5] The Registry may also be modified to impair defenses, such as by enabling macros for all Microsoft Office products, allowing privilege escalation without alerting the user, increasing the maximum number of allowed outbound requests, and/or modifying systems to store plaintext credentials in memory.[6][2]

The Registry of a remote system may be modified to aid in execution of files as part of lateral movement. It requires the remote Registry service to be running on the target system.[7] Often Valid Accounts are required, along with access to the remote system's SMB/Windows Admin Shares for RPC communication.

Finally, Registry modifications may also include actions to hide keys, such as prepending key names with a null character, which will cause an error and/or be ignored when read via Reg or other utilities using the Win32 API.[8] Adversaries may abuse these pseudo-hidden keys to conceal payloads/commands used to maintain persistence.[9][10]

EnterpriseT1112TechniqueObject v3.0 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence High

Modify Registry matters because Windows Registry changes can turn a single compromised account or host into durable access, weakened defenses, or hidden malware configuration. For leaders, this is less about one registry key and more about whether the organization can prove who changed sensitive Windows settings, whether those changes were authorized, and whether responders can quickly separate normal administration from adversary persistence or defense impairment.

Executive priority

Prioritize this technique where Windows systems support critical operations, privileged administration, remote management, Office policy, credential handling, or security tooling. ATT&CK associates the behavior with persistence and defense impairment, and relates it to multiple campaigns and groups, including energy and critical-infrastructure-relevant activity. Executives should ask whether registry change monitoring, privileged access controls, and incident response playbooks can support audit evidence and rapid containment decisions when sensitive keys are modified.

Technical view

T1112 is a Windows technique covering adversary interaction with the Registry for persistence, defense evasion, execution support, hiding payloads or configuration, and impairing defenses. Access depends on account permissions, and some areas require administrator-level access. ATT&CK notes use of the built-in Reg utility, Windows APIs, remote access tools, and remote Registry modification where the Remote Registry service is running, often with Valid Accounts and SMB/Windows Admin Shares for RPC communication. Since ATT&CK provides no official detection text for this object, teams should validate behavior-based registry modification detection using DET0280 and focus on sensitive-key changes tied to persistence, security control weakening, Office macro policy changes, plaintext credential storage behavior, and remote registry activity.

Likely telemetry

  • Windows Registry modification events from endpoint detection, host logging, or system auditing
  • Process execution telemetry for registry-capable utilities such as Reg and other administrative tools
  • Parent-child process context around scripts, remote access tools, Office-related processes, and administrative shells
  • Authentication and privilege context for accounts modifying protected registry hives or keys
  • Remote Registry service status and access evidence

Detection direction

  • Baseline legitimate administrative registry changes before alerting broadly; registry modification is common in normal Windows operations.
  • Prioritize behavior-based detections for sensitive registry locations associated with persistence, defense impairment, credential handling, Office macro policy, and hidden configuration storage.
  • Correlate registry writes with process lineage, user privilege, remote logon context, and whether the Remote Registry service or SMB admin shares were involved.
  • Tune for suspicious combinations, such as non-standard tools modifying protected keys, registry changes immediately following remote access, or security configuration changes outside maintenance windows.
  • Account for blind spots where tooling relies only on standard Win32 API views, since ATT&CK notes pseudo-hidden keys using null-character techniques may be ignored or error in some utilities.

Mitigation priorities

  • Apply M1024 Restrict Registry Permissions by reviewing and limiting write access to sensitive keys and hives.
  • Reduce unnecessary administrator-level access and validate that only authorized users or processes can modify protected registry areas.
  • Disable or tightly govern Remote Registry where not operationally required; where required, monitor access and pair it with privileged access controls.
  • Protect security tool, Office policy, credential-handling, and persistence-relevant registry areas with change control and alerting.
  • Ensure incident response procedures include registry collection, comparison against known-good baselines, and rollback decision criteria for unauthorized changes.
Analyst notes and limits

This technique is broadly applicable on Windows and is often meaningful because registry changes can be both legitimate administration and adversary tradecraft. The strongest defensive value comes from correlating registry writes with identity, privilege, process, remote access, and change-management context. Relationship data shows use by numerous groups and campaigns, including espionage, financially motivated, and critical-infrastructure-related activity, but that should inform prioritization rather than imply current targeting.

The supplied ATT&CK object does not include official detection text, specific registry paths, data sources, or procedure-level details for each related actor. Local environment baselines, approved administrative practices, endpoint telemetry availability, and registry auditing configuration are required to assess actual coverage. This take is limited to the Windows platform and relationships provided in the supplied fields.

Official MITRE ATT&CK definition

Modify Registry

Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.

Access to specific areas of the Registry depends on account permissions, with some keys requiring administrator-level access. The built-in Windows command-line utility Reg may be used for local or remote Registry modification.[1] Other tools, such as remote access tools, may also contain functionality to interact with the Registry through the Windows API.

The Registry may be modified in order to hide configuration information or malicious payloads via Obfuscated Files or Information.[2][3][4][5] The Registry may also be modified to impair defenses, such as by enabling macros for all Microsoft Office products, allowing privilege escalation without alerting the user, increasing the maximum number of allowed outbound requests, and/or modifying systems to store plaintext credentials in memory.[6][2]

The Registry of a remote system may be modified to aid in execution of files as part of lateral movement. It requires the remote Registry service to be running on the target system.[7] Often Valid Accounts are required, along with access to the remote system's SMB/Windows Admin Shares for RPC communication.

Finally, Registry modifications may also include actions to hide keys, such as prepending key names with a null character, which will cause an error and/or be ignored when read via Reg or other utilities using the Win32 API.[8] Adversaries may abuse these pseudo-hidden keys to conceal payloads/commands used to maintain persistence.[9][10]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

Associated objects

Groups, software, and campaigns

Group Enterprise

G0010: Turla

Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. Turla is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as Uroburos.[1][2][3][4][5]

Group Enterprise

G0082: APT38

APT38 is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau.[1] Active since at least 2014, APT38 has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, during which APT38 stole $81 million, as well as attacks against Bancomext [2] and Banco de Chile [2]; some of their attacks have been destructive.[1][2][3][4]

North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.

Group Enterprise

G0040: Patchwork

Patchwork is a cyber espionage group that was first observed in December 2015. While the group has not been definitively attributed, circumstantial evidence suggests the group may be a pro-Indian or Indian entity. Patchwork has been seen targeting industries related to diplomatic and government agencies. Much of the code used by this group was copied and pasted from online forums. Patchwork was also seen operating spearphishing campaigns targeting U.S. think tank groups in March and April of 2018.[1] [2][3][4]

Group Enterprise

G1051: Medusa Group

Medusa Group has been active since at least 2021 and was initially operated as a closed ransomware group before evolving into a Ransomware-as-a-Service (RaaS) operation. Some reporting indicates that certain attacks may still be conducted directly by the ransomware’s core developers. Public sources have also referred to the group as “Spearwing” or “Medusa Actors.” [1] [2] Medusa Group employs living-off-the-land techniques, frequently leveraging publicly available tools and common remote management software to conduct operations. The group engages in double extortion tactics, exfiltrating data prior to encryption and threatening to publish stolen information if ransom demands are not met. [3] For initial access, Medusa Group has exploited publicly known vulnerabilities, conducted phishing campaigns, and used credentials or access purchased from Initial Access Brokers (IABs). The group is opportunistic and has targeted a wide range of sectors globally. [4]

Group Enterprise

G0091: Silence

Silence is a financially motivated threat actor targeting financial institutions in different countries. The group was first seen in June 2016. Their main targets reside in Russia, Ukraine, Belarus, Azerbaijan, Poland and Kazakhstan. They compromised various banking systems, including the Russian Central Bank's Automated Workstation Client, ATMs, and card processing.[1][2]

Group Enterprise

G0092: TA505

TA505 is a cyber criminal group that has been active since at least 2014. TA505 is known for frequently changing malware, driving global trends in criminal malware distribution, and ransomware campaigns involving Clop.[1][2][3][4][5]

Group Enterprise

G0073: APT19

APT19 is a Chinese-based threat group that has targeted a variety of industries, including defense, finance, energy, pharmaceutical, telecommunications, high tech, education, manufacturing, and legal services. In 2017, a phishing campaign was used to target seven law and investment firms. [1] Some analysts track APT19 and Deep Panda as the same group, but it is unclear from open source information if the groups are the same. [2] [3] [4]

Group Enterprise

G1043: BlackByte

BlackByte is a ransomware threat actor operating since at least 2021. BlackByte is associated with several versions of ransomware also labeled BlackByte Ransomware. BlackByte ransomware operations initially used a common encryption key allowing for the development of a universal decryptor, but subsequent versions such as BlackByte 2.0 Ransomware use more robust encryption mechanisms. BlackByte is notable for operations targeting critical infrastructure entities among other targets across North America.[1][2][3][4][5]

Group Enterprise

G0047: Gamaredon Group

Gamaredon Group is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013. The name Gamaredon Group derives from a misspelling of the word "Armageddon," found in early campaigns.[1][2][3][4][5]

In November 2021, the Ukrainian government publicly attributed Gamaredon Group to Russia’s Federal Security Service (FSB) Center 18, an assessment later supported by multiple independent cybersecurity researchers. [6][5]

Malware Enterprise

S0596: ShadowPad

ShadowPad is a modular backdoor that was first identified in a supply chain compromise of the NetSarang software in mid-July 2017. The malware was originally thought to be exclusively used by APT41, but has since been observed to be used by various Chinese threat activity groups. [1][2][3]

Windows
Malware Enterprise

S0476: Valak

Valak is a multi-stage modular malware that can function as a standalone information stealer or downloader, first observed in 2019 targeting enterprises in the US and Germany.[1][2]

Windows
Malware Enterprise

S0533: SLOTHFULMEDIA

SLOTHFULMEDIA is a remote access Trojan written in C++ that has been used by an unidentified "sophisticated cyber actor" since at least January 2017.[1][2] It has been used to target government organizations, defense contractors, universities, and energy companies in Russia, India, Kazakhstan, Kyrgyzstan, Malaysia, Ukraine, and Eastern Europe.[3][4]

In October 2020, Kaspersky Labs assessed SLOTHFULMEDIA is part of an activity cluster it refers to as "IAmTheKing".[4] ESET also noted code similarity between SLOTHFULMEDIA and droppers used by a group it refers to as "PowerPool".[5]

Windows
Malware Enterprise

S0608: Conficker

Conficker is a computer worm first detected in October 2008 that targeted Microsoft Windows using the MS08-067 Windows vulnerability to spread.[1] In 2016, a variant of Conficker made its way on computers and removable disk drives belonging to a nuclear power plant.[2]

Windows
Campaign Enterprise

C0002: Night Dragon

Night Dragon was a cyber espionage campaign that targeted oil, energy, and petrochemical companies, along with individuals and executives in Kazakhstan, Taiwan, Greece, and the United States. The unidentified threat actors searched for information related to oil and gas field production systems, financials, and collected data from SCADA systems. Based on the observed techniques, tools, and network activities, security researchers assessed the campaign involved a threat group based in China.[1]

Relationship explorer

All related ATT&CK context

uses · Malware S0674: CharmPower Enterprise uses · Campaign C0028: 2015 Ukraine Electric Power Attack Enterprise uses · Group G0010: Turla Enterprise uses · Malware S0013: PlugX Enterprise uses · Malware S0596: ShadowPad Enterprise uses · Malware S0457: Netwalker Enterprise uses · Malware S0476: Valak Enterprise uses · Malware S0240: ROKRAT Enterprise uses · Group G0082: APT38 Enterprise uses · Malware S0376: HOPLIGHT Enterprise uses · Malware S0261: Catchamas Enterprise uses · Malware S0032: gh0st RAT Enterprise uses · Malware S0242: SynAck Enterprise uses · Malware S0533: SLOTHFULMEDIA Enterprise uses · Malware S0608: Conficker Enterprise uses · Malware S1033: DCSrv Enterprise uses · Malware S0559: SUNBURST Enterprise uses · Group G0040: Patchwork Enterprise uses · Malware S0569: Explosive Enterprise uses · Malware S0518: PolyglotDuke Enterprise uses · Malware S0012: PoisonIvy Enterprise uses · Malware S0669: KOCTOPUS Enterprise uses · Malware S1202: LockBit 3.0 Enterprise uses · Group G0119: Indrik Spider Enterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
3.0
Created
Modified
Raw hash
ecb134ca663fd927...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 3.0 Current bundle ecb134ca663f…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Microsoft Reg

    Microsoft. (2012, April 17). Reg. Retrieved May 1, 2015.

    Open source URL
  2. [2]
    Unit42 BabyShark Feb 2019

    Unit 42. (2019, February 22). New BabyShark Malware Targets U.S. National Security Think Tanks. Retrieved October 7, 2019.

    Open source URL
  3. [3]
    Avaddon Ransomware 2021

    Javier Yuste and Sergio Pastrana. (2021). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved March 24, 2025.

    Open source URL
  4. [4]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  5. [5]
    CISA Russian Gov Critical Infra 2018

    CISA. (2018, March 16). Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved March 24, 2025.

    Open source URL
  6. [6]
    CISA LockBit 2023

    CISA. (2023, March 16). #StopRansomware: LockBit 3.0. Retrieved March 24, 2025.

    Open source URL
  7. [7]
    Microsoft Remote

    Microsoft. (n.d.). Enable the Remote Registry Service. Retrieved May 1, 2015.

    Open source URL
  8. [8]
    Microsoft Reghide NOV 2006

    Russinovich, M. & Sharkey, K. (2006, January 10). Reghide. Retrieved August 9, 2018.

    Open source URL
  9. [9]
    TrendMicro POWELIKS AUG 2014

    Santos, R. (2014, August 1). POWELIKS: Malware Hides In Windows Registry. Retrieved August 9, 2018.

    Open source URL
  10. [10]
    SpectorOps Hiding Reg Jul 2017

    Reitz, B. (2017, July 14). Hiding Registry keys with PSReflect. Retrieved August 9, 2018.

    Open source URL
  11. [11]
    mitre-attack T1112
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use