BlackByteG1043 ↗
Queried registry values to determine system language settings.1
tfMITRE ATT&CK technique
Query Registry T1012
- Tactic
- Discovery
- Platform
- Windows
- Version
- 1.3
- Created
- 31 May 2017
- Last modified
- 12 May 2026
Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
19
Threat groupsTop 9%
Threat groups91st percentile · 91% of ATT&CK techniques have this many threat groups attributed or fewer.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.99
Tools & malwareTop 4%
Tools & malware96th percentile · 96% of ATT&CK techniques have this many tools implementing them or fewer.27
Detection rulesTop 10%
Detection rules90th percentile · 90% of ATT&CK techniques have this many detection rules written or fewer.Query Registry MITRE reference T1012
Top 9%of all ATT&CK techniques for number of groups
19 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
DaggerflyG1034 ↗
Used Reg to dump the Security Account Manager (SAM), System, and Security Windows registry hives from victim machines.1
Volt TyphoonG1017 ↗
Has queried the Registry on compromised systems, reg query hklm\software\, for information on installed software including PuTTY.12
ZIRCONIUMG0128 ↗
Has used a tool to query the Registry for proxy settings.1
Indrik SpiderG0119 ↗
Has used a service account to extract copies of the Security Registry hive.1
Fox KittenG0117 ↗
Has accessed Registry hives ntuser.dat and UserClass.dat.1
All 19 groups for this technique · 6 newest in this preview
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Operation WocaoC0014 ↗
During Operation Wocao, the threat actors executed /c cd /d c:\windows\temp\ & reg query HKEY_CURRENT_USER\Software\<username>\PuTTY\Sessions\ to detect recent PuTTY sessions, likely to further lateral movement.1
All 1 campaigns for this technique
99 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
QilinS1242 ↗
Can check HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control SystemStartOptions to determine if a machine is running in safe mode.1
RedLine StealerS1240 ↗
Can query the Windows Registry.1
PUBLOADS1228 ↗
Has queried Registry values to identify software using reg query.1
TRANSLATEXTS1201 ↗
Has queried the following registry key to check for installed Chrome extensions: HKCU\Software\Policies\Google\Chrome\ExtensionInstallForcelist .1
KapekaS1190 ↗
Queries registry values for stored configuration information.1
BlackByte RansomwareS1180 ↗
Enumerates the Registry, specifically the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options key.1
All 99 software entries for this technique · 6 newest in this preview
Offense vs defense T1012
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 1Sigma rules (cumulative) · 14Splunk ESCU (cumulative) · 13
first rule: 2019 Q1 · 1 of 1 campaigns plottedQuery Registry detection strategy DET0209
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Registry Query for Environmental Discovery
1 platform
AN0589 · Windows
Registry read access associated with suspicious or non-interactive processes querying system config, installed software, or security settings.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Windows Registry Key ModificationDC0063 | WinEventLog:Sysmon | EventCode=13, 14 |
| Command ExecutionDC0064 | WinEventLog:PowerShell | EventCode=4103, 4104, 4105, 4106 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TargetRegistryPath | Focus detection on registry hives or keys likely to reveal environment info (e.g., HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion). |
| ParentProcess | May tune for suspicious parent processes such as cmd.exe, wscript.exe, or mshta.exe. |
| TimeWindow | Controls how closely registry access must follow process creation for correlation. |
3 analytics
Registry modifications are often essential in establishing persistence via known Windows mechanisms. Many legitimate modifications are done graphically via regedit.exe or by using the corresponding channels, or even calling the Registry APIs directly. The built-in utility reg.exe provides a command-line interface to the registry, so that queries and modifications can be performed from a shell, such as cmd.exe. When a user is responsible for these actions, the parent of cmd.exe will likely be explorer.exe. Occasionally, power users and administrators write scripts that do this behavior as well, but likely from a different process tree. These background scripts must be learned so they can be tuned out accordingly.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PLA | Process Lineage Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| process | create | command_line |
| process | create | hostname |
| process | create | exe |
| process | create | parent_exe |
| process | create | pid |
| process | create | ppid |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
To gain better context, it may be useful to also get information about the cmd process to know its parent. This may be helpful when tuning the analytic to an environment, if this behavior happens frequently. This may also help to rule out instances of users running
processes = search Process:Create reg = filter processes where (exe == "reg.exe" and parent_exe == "cmd.exe") cmd = filter processes where (exe == "cmd.exe" and parent_exe != "explorer.exe"") reg_and_cmd = join (reg, cmd) where (reg.ppid == cmd.pid and reg.hostname == cmd.hostname) output reg_and_cmd
DNIF version of the above pseudocode.
_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $Process=regex(.*reg\.exe.*)i AND $ParentProcess=regex(.*cmd\.exe.*)i as #A limit 100 >>_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $Process=regex(.*cmd\.exe.*)i NOT $ParentProcess=regex(.*explorer\.exe.*)i as #B limit 100 >>_checkif sjoin #B.$PPID = #A.$CPID str_compare #B.$SystemName eq #A.$SystemName include
Unit tests
CAR’s own validation procedures for this analytic.
Execute reg.exe from cmd.exe. Note that the analytic joins back to the grandparent process, which in this case is explorer.exe. The query time window must include the user log on. For example, if you logged in at 8am and tested the analytic at 10am, the query needs to search from 8am to 10am, not just at 10am. Within a command window, run the command.
["reg.exe QUERY HKLM\\Software\\Microsoft"]
Certain commands are frequently used by malicious actors and infrequently used by normal users. By looking for execution of these commands in short periods of time, we can not only see when a malicious user was on the system but also get an idea of what they were doing.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PLA | Process Lineage Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| process | create | hostname |
| process | create | ppid |
| process | create | exe |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
processes = search Process:Create reg_processes = filter processes where (exe == "arp.exe" or exe == "at.exe" or exe == "attrib.exe" or exe == "cscript.exe" or exe == "dsquery.exe" or exe == "hostname.exe" or exe == "ipconfig.exe" or exe == "mimikatz.exe" or exe == "nbstat.exe" or exe == "net.exe" or exe == "netsh.exe" or exe == "nslookup.exe" or exe == "ping.exe" or exe == "quser.exe" or exe == "qwinsta.exe" or exe == "reg.exe" or exe == "runas.exe" or exe == "sc.exe" or exe == "schtasks.exe" or exe == "ssh.exe" or exe == "systeminfo.exe" or exe == "taskkill.exe" or exe == "telnet.exe" or exe == "tracert.exe" or exe == "wscript.exe" or exe == "xcopy.exe") reg_grouped = group reg by hostname, ppid where(max time between two events is 30 minutes) output reg_grouped
Sigma version of the above pseudocode, with some modifications.
DNIF version of the above pseudocode.
_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $App=regex(arp\.exe|at\.exe|attrib\.exe|cscript\.exe|dsquery\.exe|hostname\.exe|ipconfig\.exe|mimikatz.exe|nbstat\.exe|net\.exe|netsh\.exe|nslookup\.exe|ping\.exe|quser\.exe|qwinsta\.exe|reg\.exe|runas\.exe|sc\.exe|schtasks\.exe|ssh\.exe|systeminfo\.exe|taskkill\.exe|telnet\.exe|tracert\.exe|wscript\.exe|xcopy\.exe)i group count_unique $App limit 100 >>_agg count >>_checkif int_compare Count > 1 include
LogPoint version of the above pseudocode.
norm_id=WindowsSysmon event_id=1 image IN ["*\arp.exe", "*\at.exe", "*\attrib.exe", "*\cscript.exe", "*\dsquery.exe", "*\hostname.exe", "*\ipconfig.exe", "*\mimikatz.exe", "*\nbstat.exe", "*\net.exe", "*\netsh.exe", "*\nslookup.exe", "*\ping.exe", "*\quser.exe", "*\qwinsta.exe", "*\reg.exe", "*\runas.exe", "*\sc.exe", "*\schtasks.exe", "*\ssh.exe", "*\systeminfo.exe", "*\taskkill.exe", "*\telnet.exe", "*\tracert.exe", "*\wscript.exe", "*\xcopy.exe"] | chart count() as cnt by host | search cnt > 1
Unit tests
CAR’s own validation procedures for this analytic.
Within a command window, execute several of the commands in quick succession.
["ipconfig /all","hostname","systeminfo","reg.exe Query HKLM\\Software\\Microsoft"]
LoLBAS are binaries and scripts that are built in to Windows, frequently are signed by Microsoft, and may be used by an attacker. Some LoLBAS are used very rarely and it might be possible to alert every time they're used (this would depend on your environment), but many others are very common and can't be simply alerted on.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PSA | Process Spawn Analysis |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
Pseudocode version of the below Splunk query.
processes = search Process:Create lolbas_processes = filter processes where (exe = "At.exe" OR exe = "Atbroker.exe" OR exe = "Bash.exe" OR exe = "Bitsadmin.exe" OR exe = "Certutil.exe" OR exe = "Cmd.exe" OR exe = "Cmdkey.exe" OR exe = "Cmstp.exe" OR exe = "Control.exe" OR exe = "Csc.exe" OR exe = "Cscript.exe" OR exe = "Dfsvc.exe" OR exe = "Diskshadow.exe" OR exe = "Dnscmd.exe" OR exe = "Esentutl.exe" OR exe = "Eventvwr.exe" OR exe = "Expand.exe" OR exe = "Extexport.exe" OR exe = "Extrac32.exe" OR exe = "Findstr.exe" OR exe = "Forfiles.exe" OR exe = "Ftp.exe" OR exe = "Gpscript.exe" OR exe = "Hh.exe" OR exe = "Ie4uinit.exe" OR exe = "Ieexec.exe" OR exe = "Infdefaultinstall.exe" OR exe = "Installutil.exe" OR exe = "Jsc.exe" OR exe = "Makecab.exe" OR exe = "Mavinject.exe" OR exe = "Microsoft.Workflow.r.exe" OR exe = "Mmc.exe" OR exe = "Msbuild.exe" OR exe = "Msconfig.exe" OR exe = "Msdt.exe" OR exe = "Mshta.exe" OR exe = "Msiexec.exe" OR exe = "Odbcconf.exe" OR exe = "Pcalua.exe" OR exe = "Pcwrun.exe" OR exe = "Presentationhost.exe" OR exe = "Print.exe" OR exe = "Reg.exe" OR exe = "Regasm.exe" OR exe = "Regedit.exe" OR exe = "Register-cimprovider.exe" OR exe = "Regsvcs.exe" OR exe = "Regsvr32.exe" OR exe = "Replace.exe" OR exe = "Rpcping.exe" OR exe = "Rundll32.exe" OR exe = "Runonce.exe" OR exe = "Runscripthelper.exe" OR exe = "Sc.exe" OR exe = "Schtasks.exe" OR exe = "Scriptrunner.exe" OR exe = "SyncAppvPublishingServer.exe" OR exe = "Tttracer.exe" OR exe = "Verclsid.exe" OR exe = "Wab.exe" OR exe = "Wmic.exe" OR exe = "Wscript.exe" OR exe = "Wsreset.exe" OR exe = "Xwizard.exe" OR exe = "Advpack.dll OR exe = "Comsvcs.dll OR exe = "Ieadvpack.dll OR exe = "Ieaframe.dll OR exe = "Mshtml.dll OR exe = "Pcwutl.dll OR exe = "Setupapi.dll OR exe = "Shdocvw.dll OR exe = "Shell32.dll OR exe = "Syssetup.dll OR exe = "Url.dll OR exe = "Zipfldr.dll OR exe = "Appvlp.exe" OR exe = "Bginfo.exe" OR exe = "Cdb.exe" OR exe = "csi.exe" OR exe = "Devtoolslauncher.exe" OR exe = "dnx.exe" OR exe = "Dxcap.exe" OR exe = "Excel.exe" OR exe = "Mftrace.exe" OR exe = "Msdeploy.exe" OR exe = "msxsl.exe" OR exe = "Powerpnt.exe" OR exe = "rcsi.exe" OR exe = "Sqler.exe" OR exe = "Sqlps.exe" OR exe = "SQLToolsPS.exe" OR exe = "Squirrel.exe" OR exe = "te.exe" OR exe = "Tracker.exe" OR exe = "Update.exe" OR exe = "vsjitdebugger.exe" OR exe = "Winword.exe" OR exe = "Wsl.exe" OR exe = "CL_Mutexverifiers.ps1 OR exe = "CL_Invocation.ps1 OR exe = "Manage-bde.wsf OR exe = "Pubprn.vbs OR exe = "Slmgr.vbs OR exe = "Syncappvpublishingserver.vbs OR exe = "winrm.vbs OR exe = "Pester.bat) process_count = count(lolbas_processes) by process process_count_avg = average(process_count) process_count_stdev = standard_deviation(process_count) lower_bound = process_count_avg - stdev * 1.5 outliers = filter lolbas_processes where (process_count < lower_bound) return outliers
This Splunk query looks for instances of LoLBAS commands being executed, then stacks by rare command lines using a stddev.
index=__your_sysmon_index__ EventCode=1 (OriginalFileName = At.exe OR OriginalFileName = Atbroker.exe OR OriginalFileName = Bash.exe OR OriginalFileName = Bitsadmin.exe OR OriginalFileName = Certutil.exe OR OriginalFileName = Cmd.exe OR OriginalFileName = Cmdkey.exe OR OriginalFileName = Cmstp.exe OR OriginalFileName = Control.exe OR OriginalFileName = Csc.exe OR OriginalFileName = Cscript.exe OR OriginalFileName = Dfsvc.exe OR OriginalFileName = Diskshadow.exe OR OriginalFileName = Dnscmd.exe OR OriginalFileName = Esentutl.exe OR OriginalFileName = Eventvwr.exe OR OriginalFileName = Expand.exe OR OriginalFileName = Extexport.exe OR OriginalFileName = Extrac32.exe OR OriginalFileName = Findstr.exe OR OriginalFileName = Forfiles.exe OR OriginalFileName = Ftp.exe OR OriginalFileName = Gpscript.exe OR OriginalFileName = Hh.exe OR OriginalFileName = Ie4uinit.exe OR OriginalFileName = Ieexec.exe OR OriginalFileName = Infdefaultinstall.exe OR OriginalFileName = Installutil.exe OR OriginalFileName = Jsc.exe OR OriginalFileName = Makecab.exe OR OriginalFileName = Mavinject.exe OR OriginalFileName = Microsoft.Workflow.r.exe OR OriginalFileName = Mmc.exe OR OriginalFileName = Msbuild.exe OR OriginalFileName = Msconfig.exe OR OriginalFileName = Msdt.exe OR OriginalFileName = Mshta.exe OR OriginalFileName = Msiexec.exe OR OriginalFileName = Odbcconf.exe OR OriginalFileName = Pcalua.exe OR OriginalFileName = Pcwrun.exe OR OriginalFileName = Presentationhost.exe OR OriginalFileName = Print.exe OR OriginalFileName = Reg.exe OR OriginalFileName = Regasm.exe OR OriginalFileName = Regedit.exe OR OriginalFileName = Register-cimprovider.exe OR OriginalFileName = Regsvcs.exe OR OriginalFileName = Regsvr32.exe OR OriginalFileName = Replace.exe OR OriginalFileName = Rpcping.exe OR OriginalFileName = Rundll32.exe OR OriginalFileName = Runonce.exe OR OriginalFileName = Runscripthelper.exe OR OriginalFileName = Sc.exe OR OriginalFileName = Schtasks.exe OR OriginalFileName = Scriptrunner.exe OR OriginalFileName = SyncAppvPublishingServer.exe OR OriginalFileName = Tttracer.exe OR OriginalFileName = Verclsid.exe OR OriginalFileName = Wab.exe OR OriginalFileName = Wmic.exe OR OriginalFileName = Wscript.exe OR OriginalFileName = Wsreset.exe OR OriginalFileName = Xwizard.exe OR OriginalFileName = Advpack.dll OR OriginalFileName = Comsvcs.dll OR OriginalFileName = Ieadvpack.dll OR OriginalFileName = Ieaframe.dll OR OriginalFileName = Mshtml.dll OR OriginalFileName = Pcwutl.dll OR OriginalFileName = Setupapi.dll OR OriginalFileName = Shdocvw.dll OR OriginalFileName = Shell32.dll OR OriginalFileName = Syssetup.dll OR OriginalFileName = Url.dll OR OriginalFileName = Zipfldr.dll OR OriginalFileName = Appvlp.exe OR OriginalFileName = Bginfo.exe OR OriginalFileName = Cdb.exe OR OriginalFileName = csi.exe OR OriginalFileName = Devtoolslauncher.exe OR OriginalFileName = dnx.exe OR OriginalFileName = Dxcap.exe OR OriginalFileName = Excel.exe OR OriginalFileName = Mftrace.exe OR OriginalFileName = Msdeploy.exe OR OriginalFileName = msxsl.exe OR OriginalFileName = Powerpnt.exe OR OriginalFileName = rcsi.exe OR OriginalFileName = Sqler.exe OR OriginalFileName = Sqlps.exe OR OriginalFileName = SQLToolsPS.exe OR OriginalFileName = Squirrel.exe OR OriginalFileName = te.exe OR OriginalFileName = Tracker.exe OR OriginalFileName = Update.exe OR OriginalFileName = vsjitdebugger.exe OR OriginalFileName = Winword.exe OR OriginalFileName = Wsl.exe OR OriginalFileName = CL_Mutexverifiers.ps1 OR OriginalFileName = CL_Invocation.ps1 OR OriginalFileName = Manage-bde.wsf OR OriginalFileName = Pubprn.vbs OR OriginalFileName = Slmgr.vbs OR OriginalFileName = Syncappvpublishingserver.vbs OR OriginalFileName = winrm.vbs OR OriginalFileName = Pester.bat)|eval CommandLine=lower(CommandLine)|eventstats count(process) as procCount by process|eventstats avg(procCount) as avg stdev(procCount) as stdev|eval lowerBound=(avg-stdev*1.5)|eval isOutlier=if((procCount < lowerBound),1,0)|where isOutlier=1|table host, Image, ParentImage, CommandLine, ParentCommandLine, procCount
Tests6Executorscmd 4 · PowerShell 2Need elevation4 of 6Have prerequisites0Have cleanup1Platformswindows
| # | Test | Platform | Executor | Elevation | Prereqs | Cleanup | Ref | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 01 | Query Registry | windows | cmd | Required | — | — | ||||||||||
Query Windows Registry. Upon successful execution, cmd.exe will perform multiple reg queries. Some will succeed and others will fail (dependent upon OS). References: https://blog.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order https://blog.cylance.com/windows-registry-persistence-part-1-introduction-attack-phases-and-windows-services http://www.handgrep.se/repository/cheatsheets/postexploitation/WindowsPost-Exploitation.pdf https://www.offensive-security.com/wp-content/uploads/2015/04/wp.Registry_Quick_Find_Chart.en_us.pdf Attack command reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify" reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit" reg query "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell" reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell" reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run reg query HKLM\system\currentcontrolset\services /s | findstr ImagePath 2>nul | findstr /Ri ".*\.sys$" reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run reg query HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot reg query "HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components" reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup" GUID99903a42-b55e-4457-b77e-e657c64b7400 | ||||||||||||||||
| 02 | Query Registry with Powershell cmdlets | windows | PowerShell | Required | — | — | ||||||||||
Query Windows Registry with Powershell cmdlets, i.e., Get-Item and Get-ChildItem. The results from above can also be achieved with Get-Item and Get-ChildItem. Unlike using "reg query" which then executes reg.exe, using cmdlets won't generate new processes, which may evade detection systems monitoring process generation. Attack command Get-Item -Path "HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" Get-ChildItem -Path "HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\" | findstr Windows Get-Item -Path "HKLM:Software\Microsoft\Windows\CurrentVersion\RunServicesOnce" Get-Item -Path "HKCU:Software\Microsoft\Windows\CurrentVersion\RunServicesOnce" Get-Item -Path "HKLM:Software\Microsoft\Windows\CurrentVersion\RunServices" Get-Item -Path "HKCU:Software\Microsoft\Windows\CurrentVersion\RunServices" Get-Item -Path "HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify" Get-Item -Path "HKLM:Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit" Get-Item -Path "HKCU:Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell" Get-Item -Path "HKLM:Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell" Get-Item -Path "HKLM:SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad" Get-Item -Path "HKLM:Software\Microsoft\Windows\CurrentVersion\RunOnce" Get-Item -Path "HKLM:Software\Microsoft\Windows\CurrentVersion\RunOnceEx" Get-Item -Path "HKLM:Software\Microsoft\Windows\CurrentVersion\Run" Get-Item -Path "HKCU:Software\Microsoft\Windows\CurrentVersion\Run" Get-Item -Path "HKCU:Software\Microsoft\Windows\CurrentVersion\RunOnce" Get-Item -Path "HKLM:Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" Get-Item -Path "HKCU:Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" Get-ChildItem -Path "HKLM:system\currentcontrolset\services" Get-Item -Path "HKLM:Software\Microsoft\Windows\CurrentVersion\Run" Get-Item -Path "HKLM:SYSTEM\CurrentControlSet\Control\SafeBoot" Get-ChildItem -Path "HKLM:SOFTWARE\Microsoft\Active Setup\Installed Components" Get-ChildItem -Path "HKLM:SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup" GUIDba8684a0-649e-4596-84d5-bae52f9decd3 | ||||||||||||||||
| 03 | Enumerate COM Objects in Registry with Powershell | windows | PowerShell | — | — | Yes | ||||||||||
This test is designed to enumerate the COM objects listed in HKCR, then output their methods and CLSIDs to a text file. An adversary could then use this information to identify COM objects that might be vulnerable to abuse, such as using them to spawn arbitrary processes. See: https://www.mandiant.com/resources/hunting-com-objects Input arguments
Attack command New-PSDrive -PSProvider registry -Root HKEY_CLASSES_ROOT -Name HKCR
Get-ChildItem -Path HKCR:\CLSID -Name | Select -Skip 1 > $env:temp\clsids.txt
ForEach($CLSID in Get-Content "$env:temp\clsids.txt")
{try{write-output "$($Position)-$($CLSID)"
write-output "------------"| out-file #{output_file} -append
write-output $($CLSID)| out-file #{output_file} -append
$handle=[activator]::CreateInstance([type]::GetTypeFromCLSID($CLSID))
$handle | get-member -erroraction silentlycontinue | out-file #{output_file} -append
$position += 1} catch{}}
Cleanup command remove-item #{output_file} -force -erroraction silentlycontinue
remove-item $env:temp\clsids.txt -force -erroraction silentlycontinue
GUID98b534e2-ace0-47c7-9d98-e0bbf4def230 | ||||||||||||||||
| 04 | Reg query for AlwaysInstallElevated status | windows | cmd | Required | — | — | ||||||||||
The reg query commands allows to check the status of the AlwaysInstallElevated registry key for both the user and the machine. If both queries return a value of 0x1, then AlwaysInstallElevated is enabled for both user and machine thus allowing a regular user to install a Microsoft Windows Installer package with system level privileges. This can be abused by an attacker to escalate privileges in the host to SYSTEM level. Attack command reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated GUIDd8fd6d34-44c5-457c-b5c2-a487b6759b3b | ||||||||||||||||
| 05 | Check Software Inventory Logging (SIL) status via Registry | windows | cmd | Required | — | — | ||||||||||
Microsoft's Software Inventory Logging (SIL) collects information about software installed per host basis. Adversary can use such logs to passively check for existence of software of interest to them. Status of SIL can be checked via registry. Reference Attack command reg.exe query hklm\software\microsoft\windows\softwareinventorylogging /v collectionstate /reg:64 GUID61d02f4a-43c9-460e-99a4-52a437915501 | ||||||||||||||||
| 06 | Inspect SystemStartOptions Value in Registry | windows | cmd | — | — | — | ||||||||||
The objective of this test is to query the SystemStartOptions key under HKLM\SYSTEM\CurrentControlSet\Control in the Windows registry. This action could be used to uncover specific details about how the system is configured to start, potentially aiding in understanding boot parameters or identifying security-related settings. key is. Attack command reg.exe query HKLM\SYSTEM\CurrentControlSet\Control /v SystemStartOptions GUID0dbb31ff-a593-4c18-81d7-d3144a6562a4 | ||||||||||||||||
Tests from Atomic Red Team (MIT licence) · technique definition