Log in Request a demo

Attack technique

Modify Registry

Modify Registry is a technique where an attacker changes settings in the Windows Registry.

In short

Modify Registry is a technique where an attacker changes settings in the Windows Registry. The Registry holds configuration for the system and its software. Changes can help an attacker stay on a machine, hide data or weaken security settings. MITRE ATT&CK tracks it as T1112 under Defense Impairment and Persistence.

Last updated 8 October 2026

Profile MapTechnique
  1. Reconnaissance
  2. Resource Development
  3. Initial Access
  4. Execution
  5. Persistence
  6. Privilege Escalation
  7. Stealth
  8. Defense Impairment
  9. Credential Access
  10. Discovery
  11. Lateral Movement
  12. Collection
  13. Command and Control
  14. Exfiltration
  15. Impact
  1. MITRE IDT1112ATT&CK technique
  2. Detection4ways to spot itAbnormal Registry changes · Changes followed by action
  3. Defences1ways to stop itRestrict Registry permissions

How it works

The Windows Registry stores settings for the operating system and applications. Attackers touch it as part of many other techniques. What they can change depends on the account they hold, because some keys need administrator rights.

MITRE says the built-in Reg utility can be used for local or remote changes. Other tools, such as remote access tools, can also work with the Registry through the Windows API.

The Registry can hold hidden configuration data or payloads. It can also be changed to weaken defenses, for example by enabling macros in Microsoft Office, allowing privilege escalation without a prompt, or making the system keep plaintext credentials in memory.

On a remote system, Registry changes can help run files as part of lateral movement. This needs the remote Registry service to be running and often valid accounts. Attackers may also hide keys so that common tools ignore them.

A real example

MITRE ATT&CK lists these procedure examples:

  • AADInternals can modify registry keys when setting up a new pass-through authentication agent.
  • Agent Tesla can gain persistence by modifying registry key entries.
  • Amadey has overwritten registry keys for persistence.
  • Avaddon modifies several registry keys for persistence and to bypass user account control.
  • BlackCat can add a registry key on compromised networks to maintain persistence.

How to detect

  1. Abnormal Registry changes

    Look for Registry changes made through the command line, PowerShell, WMI or direct API calls, especially to keys tied to persistence, privilege escalation or defense evasion.

  2. Changes followed by action

    Watch for a Registry change that is followed by a service restart or a new process starting.

  3. Sensitive settings

    Pay attention to edits of startup-related keys and of security settings such as DLL search behavior.

  4. Detection strategy MITRE lists

    DET0280, Behavior-Based Registry Modification Detection on Windows.

How to defend

  1. Restrict Registry permissions

    Set proper permissions on Registry hives so users cannot change keys for system components, which can lead to privilege escalation.

Questions

What is the Modify Registry technique?

It is a technique where an attacker changes settings in the Windows Registry, which stores configuration for the operating system and applications. MITRE ATT&CK tracks it as T1112.

Why do attackers change the Windows Registry?

The Registry can hold hidden configuration data or payloads. It can also be changed to weaken defenses, for example by enabling macros in Microsoft Office, allowing privilege escalation without a prompt, or keeping plaintext credentials in memory.

How can defenders detect Registry tampering?

Look for Registry changes made through the command line, PowerShell, WMI or direct API calls, especially to keys tied to persistence or defense evasion. A change followed by a service restart or new process is also worth watching.

How do you defend against malicious Registry changes?

Set proper permissions on Registry hives so users cannot change keys for system components, which can lead to privilege escalation. Narrow permissions limit what an attacker can alter.

In our research

  1. BugSleep Backdoor Technical Analysis December 2025
  2. Donex Ransomware Technical Analysis August 2024
  3. KageNoHitobito Ransomware Technical Analysis August 2024
  4. Xeno RAT Technical Analysis June 2024
  5. Gamaredon Threat group

Sources

  1. MITRE ATT&CK T1112: Modify Registry MITRE
  2. MITRE ATT&CK TA0112: Defense Impairment MITRE
  3. MITRE ATT&CK TA0003: Persistence MITRE

Browse the threat library

Keep exploring

Knowledge Hub

Article

BugSleep Backdoor Technical Analysis

Technical analysis of the BugSleep backdoor attributed to MuddyWater: file transfer, reverse shell commands, scheduled task persistence and detections.

Read more

Article

Donex Ransomware Technical Analysis

Donex ransomware technical analysis: how the Windows malware encrypts local and network files, clears logs, maps to MITRE ATT&CK, and how to defend.

Read more

Threat group

Gamaredon

Attributed by Ukraine's Security Service (SSU, 2021) to Russia's FSB, and described by MITRE ATT&CK as a suspected Russian group that has targeted Ukrainian organizations since at least 2013. It mostly gets in through emails with Office files or archives, and a Ukrainian court convicted two members in absentia on 8 October 2024.

Read more

Glossary term

MITRE ATT&CK

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Read more