T1112: Modify Registry
Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.
Access to specific areas of the Registry depends on account permissions, with some keys requiring administrator-level access. The built-in Windows command-line utility Reg may be used for local or remote Registry modification.CitationMicrosoft Reg Other tools, such as remote access tools, may also contain functionality to interact with the Registry through the Windows API.
The Registry may be modified in order to hide configuration information or malicious payloads via Obfuscated Files or Information.CitationUnit42 BabyShark Feb 2019CitationAvaddon Ransomware 2021CitationMicrosoft BlackCat Jun 2022CitationCISA Russian Gov Critical Infra 2018 The Registry may also be modified to impair defenses, such as by enabling macros for all Microsoft Office products, allowing privilege escalation without alerting the user, increasing the maximum number of allowed outbound requests, and/or modifying systems to store plaintext credentials in memory.CitationCISA LockBit 2023CitationUnit42 BabyShark Feb 2019
The Registry of a remote system may be modified to aid in execution of files as part of lateral movement. It requires the remote Registry service to be running on the target system.CitationMicrosoft Remote Often Valid Accounts are required, along with access to the remote system's SMB/Windows Admin Shares for RPC communication.
Finally, Registry modifications may also include actions to hide keys, such as prepending key names with a null character, which will cause an error and/or be ignored when read via Reg or other utilities using the Win32 API.CitationMicrosoft Reghide NOV 2006 Adversaries may abuse these pseudo-hidden keys to conceal payloads/commands used to maintain persistence.CitationTrendMicro POWELIKS AUG 2014CitationSpectorOps Hiding Reg Jul 2017
Security context for executives and security teams
Modify Registry matters because Windows Registry changes can turn a single compromised account or host into durable access, weakened defenses, or hidden malware configuration. For leaders, this is less about one registry key and more about whether the organization can prove who changed sensitive Windows settings, whether those changes were authorized, and whether responders can quickly separate normal administration from adversary persistence or defense impairment.
Executive priority
Prioritize this technique where Windows systems support critical operations, privileged administration, remote management, Office policy, credential handling, or security tooling. ATT&CK associates the behavior with persistence and defense impairment, and relates it to multiple campaigns and groups, including energy and critical-infrastructure-relevant activity. Executives should ask whether registry change monitoring, privileged access controls, and incident response playbooks can support audit evidence and rapid containment decisions when sensitive keys are modified.
Technical view
T1112 is a Windows technique covering adversary interaction with the Registry for persistence, defense evasion, execution support, hiding payloads or configuration, and impairing defenses. Access depends on account permissions, and some areas require administrator-level access. ATT&CK notes use of the built-in Reg utility, Windows APIs, remote access tools, and remote Registry modification where the Remote Registry service is running, often with Valid Accounts and SMB/Windows Admin Shares for RPC communication. Since ATT&CK provides no official detection text for this object, teams should validate behavior-based registry modification detection using DET0280 and focus on sensitive-key changes tied to persistence, security control weakening, Office macro policy changes, plaintext credential storage behavior, and remote registry activity.
Likely telemetry
- Windows Registry modification events from endpoint detection, host logging, or system auditing
- Process execution telemetry for registry-capable utilities such as Reg and other administrative tools
- Parent-child process context around scripts, remote access tools, Office-related processes, and administrative shells
- Authentication and privilege context for accounts modifying protected registry hives or keys
- Remote Registry service status and access evidence
Detection direction
- Baseline legitimate administrative registry changes before alerting broadly; registry modification is common in normal Windows operations.
- Prioritize behavior-based detections for sensitive registry locations associated with persistence, defense impairment, credential handling, Office macro policy, and hidden configuration storage.
- Correlate registry writes with process lineage, user privilege, remote logon context, and whether the Remote Registry service or SMB admin shares were involved.
- Tune for suspicious combinations, such as non-standard tools modifying protected keys, registry changes immediately following remote access, or security configuration changes outside maintenance windows.
- Account for blind spots where tooling relies only on standard Win32 API views, since ATT&CK notes pseudo-hidden keys using null-character techniques may be ignored or error in some utilities.
Mitigation priorities
- Apply M1024 Restrict Registry Permissions by reviewing and limiting write access to sensitive keys and hives.
- Reduce unnecessary administrator-level access and validate that only authorized users or processes can modify protected registry areas.
- Disable or tightly govern Remote Registry where not operationally required; where required, monitor access and pair it with privileged access controls.
- Protect security tool, Office policy, credential-handling, and persistence-relevant registry areas with change control and alerting.
- Ensure incident response procedures include registry collection, comparison against known-good baselines, and rollback decision criteria for unauthorized changes.
Additional notes and limits
This technique is broadly applicable on Windows and is often meaningful because registry changes can be both legitimate administration and adversary tradecraft. The strongest defensive value comes from correlating registry writes with identity, privilege, process, remote access, and change-management context. Relationship data shows use by numerous groups and campaigns, including espionage, financially motivated, and critical-infrastructure-related activity, but that should inform prioritization rather than imply current targeting.
The supplied ATT&CK object does not include official detection text, specific registry paths, data sources, or procedure-level details for each related actor. Local environment baselines, approved administrative practices, endpoint telemetry availability, and registry auditing configuration are required to assess actual coverage. This take is limited to the Windows platform and relationships provided in the supplied fields.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Modify Registry
Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.
Access to specific areas of the Registry depends on account permissions, with some keys requiring administrator-level access. The built-in Windows command-line utility Reg may be used for local or remote Registry modification.CitationMicrosoft Reg Other tools, such as remote access tools, may also contain functionality to interact with the Registry through the Windows API.
The Registry may be modified in order to hide configuration information or malicious payloads via Obfuscated Files or Information.CitationUnit42 BabyShark Feb 2019CitationAvaddon Ransomware 2021CitationMicrosoft BlackCat Jun 2022CitationCISA Russian Gov Critical Infra 2018 The Registry may also be modified to impair defenses, such as by enabling macros for all Microsoft Office products, allowing privilege escalation without alerting the user, increasing the maximum number of allowed outbound requests, and/or modifying systems to store plaintext credentials in memory.CitationCISA LockBit 2023CitationUnit42 BabyShark Feb 2019
The Registry of a remote system may be modified to aid in execution of files as part of lateral movement. It requires the remote Registry service to be running on the target system.CitationMicrosoft Remote Often Valid Accounts are required, along with access to the remote system's SMB/Windows Admin Shares for RPC communication.
Finally, Registry modifications may also include actions to hide keys, such as prepending key names with a null character, which will cause an error and/or be ignored when read via Reg or other utilities using the Win32 API.CitationMicrosoft Reghide NOV 2006 Adversaries may abuse these pseudo-hidden keys to conceal payloads/commands used to maintain persistence.CitationTrendMicro POWELIKS AUG 2014CitationSpectorOps Hiding Reg Jul 2017
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.