tool

Reg S0075

Type: tool
Platform: Windows
Created: 31 May 2017
Last modified: 16 April 2025

Reg is a Windows utility used to interact with the Windows Registry. It can be used at the command-line interface to query, add, modify, and remove information. [1]

Utilities such as Reg are known to be used by persistent threats. [2]

TechniquesBottom 12%

Tactics32nd pct

Threat groupsunranked

Campaignunranked

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S0075

Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Detects file access requests to files ending with either the ".hive"/".reg" extension, usually associated with Windows Registry backups.	Hunting	test	file_access	windows	-	Persistence, Defense Impairment Modify Registry	-	low	frack113	2023-09-15	2024-07-29	337a31c6-46c4-46be-886a-260d7aa78cac
	Detect set Notification_Suppress to 1 to disable the Windows security center notification	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	frack113	2022-08-19	2023-08-17	0c93308a-3f1b-40a9-b649-57ea1a1c1d63
Splunk	The following analytic detects suspicious registry modifications that implement auto admin logon by adding DefaultUserName and DefaultPassword values. (...)	Anomaly	stable	registry_event	windows	Sysmon	Credential Access Unsecured Credentials Credentials in Registry	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-09-06	2026-05-13	d4a3eb62-0f1e-11ec-a971-acde48001122
	Detect set DisallowRun to 1 to prevent user running specific computer program	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	frack113	2022-08-19	2023-08-17	275641a5-a492-45e2-a817-7c81e9d9d3e9
	Detect enable rdp feature to allow specific user to rdp connect on the targeted machine	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	frack113	2022-08-19	2023-08-17	37b437cf-3fc5-4c8e-9c94-1d7c9aff842b
Splunk	The following analytic detects a suspicious registry modification that enables auto admin logon on a host. (...)	Generic	stable	registry_event	windows	Sysmon	Credential Access Unsecured Credentials Credentials in Registry	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-09-06	2026-05-13	1379d2b8-0f18-11ec-8ca3-acde48001122
	This detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health monitoring agent. (...)	Generic	test	-	windows	WinEventLog Security	Discovery Query Registry	-	medium	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC	2021-08-26	2022-10-09	ff151c33-45fa-475d-af4f-c2f93571f4fe
	This detection uses Windows security events to detect suspicious access attempts to the registry key values and sub-keys of Azure AD Health service agents (e.g AD FS). (...)	Generic	test	-	windows	WinEventLog Security	Discovery Query Registry	-	medium	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC	2021-08-26	2022-10-09	1d2ab8ac-1a01-423b-9c39-001510eae8e8
	Detects specific windows registry modifications made by BlackByte ransomware variants. (...)	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	high	frack113	2022-01-24	2025-10-21	83314318-052a-4c90-a1ad-660ece38d276
	Attempts to detect system changes made by Blue Mockingbird	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry Execution Windows Management Instrumentation	-	high	Trent Liffick (@tliffick)	2020-05-14	2022-10-09	c3198a27-23a0-4c2c-af19-e5328d49680e
	Attempts to detect system changes made by Blue Mockingbird	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry Execution Windows Management Instrumentation	-	high	Trent Liffick (@tliffick)	2020-05-14	2023-08-17	92b0b372-a939-44ed-a11b-5136cf680e27
	Detect possible persistence using Fax DLL load when service restart	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	high	frack113	2022-07-17	2022-12-30	9e3357ba-09d4-4fbd-a7c5-ad6386314513
	Detect change of the user account associated with the FAX service to avoid the escalation problem.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	high	frack113	2022-07-17	2022-12-30	e3fdf743-f05b-4051-990a-b66919be1743
	Detects changes to the ClickOnce trust prompt registry key in order to enable an installation from different locations such as the Internet.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	@SerkinValery, Nasreddine Bencherchali (Nextron Systems)	2023-06-12	2023-08-17	ac9159cc-c364-4304-8f0a-d63fc1a0aabb
	Detects disabling the CrashDump per registry (as used by HermeticWiper)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Stealth Hide Artifacts Persistence, Defense Impairment Modify Registry	-	medium	Tobias Michalski (Nextron Systems)	2022-02-24	2023-08-17	2ff692c2-4594-41ec-8fcb-46587de769e0
	Detects changes to the "Ports" registry key with data that includes a Windows path or a file with a suspicious extension. (...)	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	CVE-2020-1048	high	EagleEye Team, Florian Roth (Nextron Systems), NVISO	2020-05-13	2024-03-25	7ec912f2-5175-4868-b811-ec13ad0f8567
	Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Execution, Stealth Hijack Execution Flow DLL Persistence, Defense Impairment Modify Registry	-	high	Dimitrios Slamaris	2017-05-15	2023-08-17	9d3436ef-9476-4c43-acca-90ce06bdf33a
	Detects registry modifications that change features of internal Windows tools (malware like Agent Te (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	frack113, Nasreddine Bencherchali (Nextron Systems), CrimpSec	2022-03-18	2025-06-04	e2482f8d-3443-4237-b906-cc145d87a076
Splunk	The following analytic detects modifications to the Windows registry aimed at disabling the Registry Editor (regedit). (...)	Generic	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools Persistence, Defense Impairment Modify Registry	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-03-31	2026-10-02	cd2cf33c-9201-11eb-a10a-acde48001122
	Detects the addition of a key 'MiniNt' to the registry. (...)	Generic	test	registry_event	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log Persistence, Defense Impairment Modify Registry	-	high	Ilyas Ochkov, oscd.community	2019-10-25	2021-11-27	919f2ef0-be2d-4a7a-b635-eb2b41fde044
Splunk	The following analytic detects a suspicious registry modification aimed at disabling security audit logs by adding a specific registry entry. (...)	Generic	stable	registry_event	windows	Sysmon	Persistence, Defense Impairment Modify Registry	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-10-05	2026-05-13	39ebdc68-25b9-11ec-aec7-acde48001122
Splunk	The following analytic detects modifications to the Windows registry that disable the display of hidden files. (...)	Anomaly	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools Stealth Hide Artifacts Hidden Files and Directories Persistence, Defense Impairment Modify Registry	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-03-31	2026-05-13	6f3ccfa2-91fe-11eb-8f9b-acde48001122
Splunk	The following analytic detects a suspicious registry modification aimed at disabling Windows hotkeys for native applications. (...)	Generic	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools Persistence, Defense Impairment Modify Registry	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-05-07	2026-05-13	1490f224-ad8b-11eb-8c4f-acde48001122
	Detect set UseActionCenterExperience to 0 to disable the Windows security center notification	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	frack113	2022-08-19	2023-08-17	3ae1a046-f7db-439d-b7ce-b8b366b81fa6
Splunk	The following analytic detects modifications to the registry that disable the CMD prompt application. (...)	Generic	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools Persistence, Defense Impairment Modify Registry	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-03-31	2026-10-02	ff86077c-9212-11eb-a1e6-acde48001122
Splunk	The following analytic detects registry modifications that disable the Control Panel on Windows systems. (...)	Generic	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools Persistence, Defense Impairment Modify Registry	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-03-31	2026-05-13	6ae0148e-9215-11eb-a94a-acde48001122
Splunk	The following analytic detects the modification of the Windows registry to disable the Run application in the Start menu. (...)	Generic	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools Persistence, Defense Impairment Modify Registry	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-03-31	2026-05-13	de81bc46-9213-11eb-adc9-acde48001122
	Detects when a user enables DNS-over-HTTPS. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Stealth Deobfuscate/Decode Files or Information Persistence, Defense Impairment Modify Registry	-	medium	Austin Songer	2021-07-22	2023-08-17	04b45a8a-d11d-49e4-9acc-4a1b524407a5
	Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-12-15	—	c420410f-c2d8-4010-856b-dffe21866437
	Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-12-15	2023-12-22	98dedfdd-8333-49d4-9f23-d7018cccae53
Splunk	The following analytic detects a suspicious registry modification that enables the plain text credential feature in Windows by setting the "UseLogonCredential" value to 1 in the WDigest registry path. (...)	Generic	stable	registry_event	windows	Sysmon	Persistence, Defense Impairment Modify Registry Credential Access OS Credential Dumping	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-10-05	2026-10-09	0c7d8ffe-25b1-11ec-9f39-acde48001122
	Detects processes that query known 3rd party registry keys that holds credentials via commandline	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access Unsecured Credentials Credentials in Registry	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-06-20	2025-05-22	87a476dc-0079-4583-a985-dee7a20a03de
	Adversaries may search the Registry on compromised systems for insecurely stored credentials. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access Unsecured Credentials Credentials in Registry	-	medium	frack113	2021-12-20	2022-12-25	e0b0c2ab-3d52-46d9-8cb7-049dc775fbd1
	Detects changes to the "ExtErrorInformation" key in order to disable ETW logging for rpcrt4.dll	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools Persistence, Defense Impairment Modify Registry	-	low	Nasreddine Bencherchali (Nextron Systems)	2022-12-09	2023-08-17	90f342e1-1aaa-4e43-b092-39fda57ed11e
	Detects changes to the "TracingDisabled" key in order to disable ETW logging for services.exe (SCM)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools Persistence, Defense Impairment Modify Registry	-	low	Nasreddine Bencherchali (Nextron Systems)	2022-12-09	2023-08-17	4f281b83-0200-4b34-bf35-d24687ea57c2
	Potential adversaries stopping ETW providers recording loaded .NET assemblies.	Generic	test	registry_event	windows	WinEventLog Security	Defense Impairment Disable or Modify Tools Persistence, Defense Impairment Modify Registry	-	high	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)	2020-06-05	2022-12-20	a4c90ea1-2634-4ca0-adbb-35eae169b6fc
	Potential adversaries stopping ETW providers recording loaded .NET assemblies.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools Persistence, Defense Impairment Modify Registry	-	high	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)	2020-06-05	2023-08-17	bf4fc428-dcc3-4bbd-99fe-2422aeee2544
	Detects the export of a crital Registry key to a file.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Query Registry	-	high	Oddvar Moe, Sander Wiebing, oscd.community	2020-10-12	2024-03-13	82880171-b475-4201-b811-e9c826cd5eaa
	Detects the export of the target Registry key to a file.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Query Registry	-	low	Oddvar Moe, Sander Wiebing, oscd.community	2020-10-07	2024-03-13	f0e53e89-8d22-46ea-9db5-9d4796ee2f8a
	Detects FlowCloud malware registry markers from threat group TA410. (...)	Emerging	test	registry_event	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	critical	NVISO	2020-06-09	2024-03-20	5118765f-6657-4ddb-a487-d7bd673abbf1
Splunk	The following analytic detects the execution of fodhelper.exe, which is known to exploit a User Account Control (UAC) bypass by leveraging specific registry keys. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control Persistence, Defense Impairment Modify Registry	-	medium	Michael Haag, Splunk	2021-03-01	2026-10-02	909f8fd8-7ac8-11eb-a1f3-acde48001122
	Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, ker (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery File and Directory Discovery Discovery Process Discovery Discovery Query Registry Discovery System Information Discovery Discovery System Service Discovery	-	high	Florian Roth (Nextron Systems), Nasreddine Bencherchali	2022-10-10	2024-11-23	fca949cc-79ca-446e-8064-01aa7e52ece5
	Detects the import of the specified file to the registry with regedit.exe.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	Oddvar Moe, Sander Wiebing, oscd.community	2020-10-07	2024-03-13	73bba97f-a82d-42ce-b315-9182e76c57b1
	Detects the import of a alternate datastream to the registry with regedit.exe.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	high	Oddvar Moe, Sander Wiebing, oscd.community	2020-10-12	2024-03-13	0b80ade5-6997-4b1d-99a1-71701778ea61
	Detects registry changes to Office trust records where the path is located in a potentially suspicio (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-06-21	2023-08-17	a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd
Splunk	The following analytic detects a process modifying the registry with a known malicious CLSID under InProcServer32. (...)	Generic	stable	registry_event	windows	Sysmon	Persistence, Defense Impairment Modify Registry Stealth System Binary Proxy Execution Regsvr32	-	medium	Michael Haag, Splunk	2021-10-05	2026-05-13	127c8d08-25ff-11ec-9223-acde48001122
	Detects changes to the registry keys related to "Trusted Location" of Microsoft Office. (...)	Hunting	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-06-21	2023-08-17	a0bed973-45fa-4625-adb5-6ecdf9be70ac
	Detects modification of the registry settings used for Internet Explorer and other Windows components that use these settings. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	low	frack113	2022-01-22	2025-10-22	d88d0ab2-e696-4d40-a2ed-9790064e66b3
	Detects changes to the NGenAssemblyUsageLog registry key. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	high	frack113	2022-11-18	2023-08-17	28036918-04d3-423d-91c0-55ecf99fb892
	Detects NetNTLM downgrade attack	Generic	test	registry_event	windows	WinEventLog Security	Defense Impairment Disable or Modify Tools Persistence, Defense Impairment Modify Registry	-	high	Florian Roth (Nextron Systems), wagga	2018-03-20	2022-10-09	d3abac66-f11c-4ed0-8acb-50cc29c97eed

Title

Description

Reg S0075

Reg MITRE reference S0075

Standing S0075

Reach

Coverage

Reg detections S0075