Modify Registry `T1112`

Tactics: Defense Impairment, Persistence

Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.

Events covered

20 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 7	Image loaded
Sysmon	Event ID 12	RegistryEvent (Object create and delete)
Sysmon	Event ID 13	RegistryEvent (Value Set)
Sysmon	Event ID 14	RegistryEvent (Key and Value Rename)
Security-Auditing	Event ID 4657	A registry value was modified.
Security-Auditing	Event ID 4663	An attempt was made to access an object.
Security-Auditing	Event ID 4674	An operation was attempted on a privileged object.
Security-Auditing	Event ID 4688	A new process has been created.
Security-Auditing	Event ID 4697	A service was installed in the system.
Security-Auditing	Event ID 4698	A scheduled task was created.
Defender-DeviceRegistryEvents	RegistryKeyDeleted	Registry key deleted
Defender-DeviceRegistryEvents	RegistryValueSet	Registry value set
Defender-DeviceRegistryEvents	RegistryValueDeleted	Registry value deleted
Defender-DeviceRegistryEvents	RegistryKeyRenamed	Registry key renamed
PowerShell	Event ID 4103	Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104	Creating Scriptblock text (MessageNumber of MessageTotal).
Windows-Defender	Event ID 5007	Product Name Configuration has changed.
RPCFW	Event ID 3	An RPC server function was called.
Service-Control-Manager	Event ID 7045	A service was installed in the system.

Authoring guide

These 307 rules share fields, values, and exclusions.

Fields filtered most (70 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`Details`	175	`eq` 118, `is_not_null` 38, `contains` 15, `starts_with` 10, `wildcard` 7, `ends_with` 6, `length_compare` 5, `in` 3, `is_null` 2, `match` 1, `ne` 1, `regex_match` 1	`0x00000001`, `0`, `dword (0x00000001)`, `0x00000000`, `dword (0x00000000)`
`TargetObject`	137	`wildcard` 54, `ends_with` 51, `contains` 34, `eq` 9, `regex_match` 5, `starts_with` 3, `in` 1, `is_not_null` 1, `match` 1	`h\software\microsoft\windows\currentversion\run\`, `hkey_users\\environment\userinitmprlogonscript`, `hkey_users\\software\microsoft\command processor\autorun`, `h\software\microsoft\windows\currentversion\policies\exp...`, `hkey_users\\software\microsoft\ctf\langbaraddin\*\filepath`
`registry_path`	68	`contains` 33, `ends_with` 33, `eq` 1, `in` 1	`\\software\\microsoft\\windows\\currentversion\\policies\...`, `\\inprocserver32\\`, `\\kingsoft\\antivirus\\kavreport\\`, `\\kingsoft\\antivirus\\ksetting\\`, `\\kingsoft\\antivirus\\windhunter\\`
`registry_value_name`	58	`eq` 51, `in` 6, `ne` 1, `regex_match` 1	`start`, `LmCompatibilityLevel`, `consentpromptbehavioradmin`, `debugger`, `disablearchivescanning`
`Image`	55	`ends_with` 27, `is_not_null` 13, `starts_with` 12, `contains` 7, `eq` 7, `wildcard` 3, `is_null` 1, `ne` 1, `regex_match` 1	`\reg.exe`, `?:\`, `\powershell.exe`, `\pwsh.exe`, `:\program files (x86)\microsoft office\`
`host.os.type`	43	`eq` 43
`EventType`	40	`eq` 29, `ne` 9, `in` 2	`modification`, `deletion`, `start`, `modified`, `deleted`
`event.type`	38	`eq` 35, `in` 3	`change`, `creation`, `start`
`CommandLine`	29	`contains` 24, `regex_match` 7, `ends_with` 2	`add` , `-a` , `-c` , `-e` , `/f`
`EventID`	29	`eq` 28, `in` 1	`4688`, `1`, `4104`, `13`, `4103`
`process_name`	21	`eq` 14, `is_not_null` 2, `regex_match` 2, `ends_with` 1, `in` 1, `wildcard` 1	`cscript.exe`, `powershell.exe`, `mshta.exe`, `(?i)\x5cregini\.exe`, `cmd.exe`
`OriginalFileName`	15	`eq` 15	`reg.exe`, `powershell.exe`, `pwsh.dll`, `regedit.exe`, `regini.exe`
`user.id`	9	`starts_with` 6, `ne` 3	`S-1-12-`, `S-1-5-21`, `S-1-5-18`
`Type`	8	`eq` 8
`process.code_signature.exists`	8	`eq` 8	`false`

Top indicator values (1373 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`Details`	`eq`	`0x00000001` elasticCode Signing Policy Modification Through Registry elasticDNS-over-HTTPS Enabled via Registry elasticLocal Account TokenFilter Policy Disabled elasticMicrosoft Windows Defender Tampering elasticModification of WDigest Security Provider elasticMS Office Macro Security Registry Modifications elasticWindows Defender Disabled via Registry Modification splunkDisable Registry Tool splunkDisable Show Hidden Files splunkDisabling CMD Application splunkDisabling ControlPanel splunkDisabling NoRun Windows App splunkEnable WDigest UseLogonCredential Registry splunkWindows Disable Change Password Through Registry splunkWindows Disable Lock Workstation Feature Through Registry +25 more rules	40	61
`Details`	`eq`	`dword (0x00000001)` sigmaActivate Suppression of Windows Security Center Notifications sigmaAdd DisallowRun Execution to Registry sigmaAllow RDP Remote Assistance Feature sigmaBlackbyte Ransomware Registry sigmaDisable Internal Tools or Feature in Registry sigmaDNS-over-HTTPS Enabled by Registry sigmaETW Logging Disabled For SCM sigmaNetNTLM Downgrade Attack - Registry sigmaOffice Macros Warning Disabled sigmaOutlook EnableUnsafeClientMailRules Setting Enabled - Registry sigmaPotential Persistence Via Outlook Today Page sigmaPotentially Suspicious Desktop Background Change Via Registry sigmaRDP Sensitive Settings Changed sigmaRegistry Explorer Policy Modification sigmaRegistry Hide Function from User +7 more rules	22	40
`Details`	`eq`	`0` sigmaETW Logging Disabled In .NET Processes - Registry sigmaETW Logging Disabled In .NET Processes - Sysmon Registry sigmaSysmon Channel Reference Deletion elasticAttempt to Disable Windows Driver Blocklist via Registry elasticAttempt to Hide Files via Registry Modification elasticCode Signing Policy Modification Through Registry elasticCrashDump Disabled via Registry Modification elasticDefense Evasion via Registry Modification elasticDisabling Hypervisor-protected Code Integrity via Registry elasticDisabling User Account Control via Registry Modification elasticDNS Global Query Block List Modified or Disabled elasticMicrosoft Windows Defender Tampering elasticModification of AmsiEnable Registry Key elasticNetwork-Level Authentication (NLA) Disabled elasticPowerShell Script Block Logging Disabled +2 more rules	17	18
`Details`	`eq`	`0x00000000` elasticCode Signing Policy Modification Through Registry elasticDisabling User Account Control via Registry Modification elasticDNS Global Query Block List Modified or Disabled elasticMicrosoft Windows Defender Tampering elasticModification of AmsiEnable Registry Key elasticNetwork-Level Authentication (NLA) Disabled elasticPowerShell Script Block Logging Disabled elasticRDP Enabled via Registry splunkDisable Show Hidden Files splunkWindows Disable Shutdown Button Through Registry splunkWindows Impair Defenses Disable AV AutoStart via Registry splunkWindows Modify Registry AuthenticationLevelOverride splunkWindows Modify Registry Auto Minor Updates splunkWindows Modify Registry Disable Restricted Admin splunkWindows Modify Registry Disable Toast Notifications +2 more rules	17	41
`Details`	`eq`	`1` elasticAllowProtectedRenames Registry Modification elasticAttempt to Hide Files via Registry Modification elasticCode Signing Policy Modification Through Registry elasticDefense Evasion via Registry Modification elasticDNS-over-HTTPS Enabled via Registry elasticLocal Account TokenFilter Policy Disabled elasticMicrosoft Windows Defender Tampering elasticModification of WDigest Security Provider elasticMS Office Macro Security Registry Modifications elasticPotential PlugX Registry Modification elasticSuspicious MS Office Execution via DCOM elasticSuspicious Windows Defender Registry Modification elasticWindows Defender Disabled via Registry Modification splunkWindows Modify Registry NoChangingWallPaper	14	20
`Details`	`eq`	`dword (0x00000000)` sigmaCrashControl CrashDump Disabled sigmaDisable Internal Tools or Feature in Registry sigmaDisable Windows Security Center Notifications sigmaEnable LM Hash Storage sigmaETW Logging Disabled For rpcrt4.dll sigmaETW Logging Disabled In .NET Processes - Sysmon Registry sigmaNetNTLM Downgrade Attack - Registry sigmaPowerShell Logging Disabled Via Registry Key Tampering sigmaRDP Sensitive Settings Changed to Zero sigmaRegistry Hide Function from User sigmaService Binary in Suspicious Folder chronicleDisable Internal Tools or Feature in Registry chronicleRDP Sensitive Settings Changed to Zero	13	38
`Details`	`eq`	`4` elasticService Disabled via Registry Modification elasticShadow Copy Service Disabled via Registry Modification elasticSolarWinds Process Disabling Services via Registry elasticSuspicious Remote Registry Modification elasticUnusual Windows System Service Disabled elasticVSS Service Disabled Followed by a Suspicious File Rename	6	7
`event.type`	`eq`	`change` elasticCode Signing Policy Modification Through Registry elasticCOM to .NET Redirection via Registry elasticComponent Object Model Hijacking elasticDisabling Lsa Protection via Registry Modification elasticDisabling User Account Control via Registry Modification elasticDNS Global Query Block List Modified or Disabled elasticDNS-over-HTTPS Enabled via Registry elasticImage File Execution Options Injection elasticInstallation of Security Support Provider elasticLocal Account TokenFilter Policy Disabled elasticMicrosoft Windows Defender Tampering elasticMS Office Macro Security Registry Modifications elasticNetsh Helper DLL elasticNullSessionPipe Registry Modification elasticPersistence via Hidden Run Key Detected +18 more rules	33	94
`EventType`	`eq`	`modification` elasticAttempt to Hide Files via Registry Modification elasticDisabling Hypervisor-protected Code Integrity via Registry elasticPotential Elastic Tampering via PendingFileRename elasticPotential NetNTLMv1 Downgrade Attack elasticRemcos RAT ExePath Registry Modification elasticSuspicious Antivirus Registration elasticSuspicious BootExecute Registry Modification elasticSuspicious NullSessionPipe Registry Modification elasticSuspicious Registry Modification via WMI elasticSuspicious Registry Symbolic Link elasticSuspicious Remote Registry Modification elasticSuspicious Scheduled Task Registry Modification elasticSuspicious Windows Authentication Registry Modification elasticUncommon Persistence via Registry Modification	14	72
`EventID`	`eq`	`4688` splunkDefender Registry Values Modified (Windows Event Log) splunkHTTP_HTTPS Default Security Zone Modified to Local Machine (Windows Event Log) splunkLocalAccountTokenFilterPolicy Registry Value Modified (Windows Event Log) splunkPossible Credential Dumping via Windows Network Providers (Windows Event Log) splunkPowerShell Modifying Registry Values (Windows Event Log) splunkRDP Enabled (Windows Event Log) splunkReg.exe Process Execution (Windows Event Log) splunkRegini.exe Execution (Windows Event Log) splunkRegistry key added with reg.exe (Windows Event Log) splunkWDigest Forced Credential Caching (Windows Event Log)	10	317
`EventID`	`eq`	`1` splunkDefender Registry Values Modified (Sysmon) splunkLocalAccountTokenFilterPolicy Registry Value Modified (Sysmon) splunkPowerShell Modifying Registry Values (Sysmon) splunkRDP Enabled (Sysmon) splunkReg.exe Process Execution (Sysmon) splunkRegini.exe Execution (Sysmon) splunkRegistry key added with reg.exe (Sysmon) splunkWDigest Forced Credential Caching (Sysmon)	8	241
`EventID`	`eq`	`4104` splunkHTTP_HTTPS Default Security Zone Modified to Local Machine (PowerShell) splunkLocalAccountTokenFilterPolicy Registry Value Modified (PowerShell) splunkPossible Credential Dumping via Windows Network Providers (PowerShell) splunkPowerShell Modifying Registry Values (PowerShell) splunkRegistry Entry Created - PowerShell (PowerShell) splunkWDigest Forced Credential Caching (PowerShell)	6	269
`EventType`	`ne`	`deletion` elasticDual Persistence via Startup and Scheduled Task elasticNetwork-Level Authentication (NLA) Disabled elasticOffice Test Registry Persistence elasticOutlook Home Page Registry Modification elasticPersistence via WinSock Name Space DLL elasticPotential NetNTLMv1 Downgrade Attack elasticPotential RemoteMonologue Attack elasticRegistry or File Modification from Suspicious Memory elasticUntrusted Process Writing to Commonly Abused Persistence Locations	9	86
`Image`	`ends_with`	`\reg.exe` sigmaPotential Suspicious Registry File Imported Via Reg.EXE sigmaPotential Tampering With RDP Related Registry Keys Via Reg.EXE sigmaPotentially Suspicious Desktop Background Change Using Reg.EXE sigmaReg Add Suspicious Paths sigmaRegistry Modification of MS-settings Protocol Handler sigmaRemoval of Potential COM Hijacking Registry Keys sigmaSecurity Event Logging Disabled via MiniNt Registry Key - Process sigmaUser Shell Folders Registry Modification via CommandLine	8	58
`OriginalFileName`	`eq`	`reg.exe` sigmaPotential Suspicious Registry File Imported Via Reg.EXE sigmaPotential Tampering With RDP Related Registry Keys Via Reg.EXE sigmaPotentially Suspicious Desktop Background Change Using Reg.EXE sigmaReg Add Suspicious Paths sigmaRegistry Modification of MS-settings Protocol Handler sigmaSecurity Event Logging Disabled via MiniNt Registry Key - Process sigmaUser Shell Folders Registry Modification via CommandLine elasticFile or Directory Deletion Command	8	43
`TargetObject`	`wildcard`	`hkey_users\*\environment\userinitmprlogonscript` elasticDual Persistence via Startup and Scheduled Task elasticRegistry Modification via Microsoft Office elasticRegistry or File Modification from Suspicious Memory elasticRegistry Persistence via Microsoft Office Descendant Process elasticSuspicious Registry Modification via WMI elasticUncommon Persistence via Registry Modification elasticUncommon Registry Persistence Change elasticUntrusted Process Writing to Commonly Abused Persistence Locations	8	12
`TargetObject`	`wildcard`	`hkey_users\*\software\microsoft\windows nt\currentversion\windows\load` elasticDual Persistence via Startup and Scheduled Task elasticRegistry Modification via Microsoft Office elasticRegistry or File Modification from Suspicious Memory elasticRegistry Persistence via Microsoft Office Descendant Process elasticSuspicious Registry Modification via WMI elasticUncommon Persistence via Registry Modification elasticUncommon Registry Persistence Change elasticUntrusted Process Writing to Commonly Abused Persistence Locations	8	12
`TargetObject`	`wildcard`	`hkey_users\*\software\microsoft\windows nt\currentversion\winlogon\shell` elasticDual Persistence via Startup and Scheduled Task elasticRegistry Modification via Microsoft Office elasticRegistry or File Modification from Suspicious Memory elasticRegistry Persistence via Microsoft Office Descendant Process elasticSuspicious Registry Modification via WMI elasticUncommon Persistence via Registry Modification elasticUncommon Registry Persistence Change elasticUntrusted Process Writing to Commonly Abused Persistence Locations	8	12
`TargetObject`	`wildcard`	`hkey_users\*\software\microsoft\command processor\autorun` elasticDual Persistence via Startup and Scheduled Task elasticRegistry Modification via Microsoft Office elasticRegistry or File Modification from Suspicious Memory elasticRegistry Persistence via Microsoft Office Descendant Process elasticSuspicious Registry Modification via WMI elasticUncommon Persistence via Registry Modification elasticUncommon Registry Persistence Change	7	11
`TargetObject`	`wildcard`	`hkey_users\\software\microsoft\ctf\langbaraddin\\filepath` elasticDual Persistence via Startup and Scheduled Task elasticRegistry Modification via Microsoft Office elasticRegistry or File Modification from Suspicious Memory elasticRegistry Persistence via Microsoft Office Descendant Process elasticSuspicious Registry Modification via WMI elasticUncommon Persistence via Registry Modification elasticUncommon Registry Persistence Change	7	11
`TargetObject`	`wildcard`	`hkey_users\\software\microsoft\internet explorer\extensions\\exec` elasticDual Persistence via Startup and Scheduled Task elasticRegistry Modification via Microsoft Office elasticRegistry or File Modification from Suspicious Memory elasticRegistry Persistence via Microsoft Office Descendant Process elasticSuspicious Registry Modification via WMI elasticUncommon Persistence via Registry Modification elasticUncommon Registry Persistence Change	7	11
`TargetObject`	`wildcard`	`hkey_users\*\software\microsoft\windows\currentversion\policies\system\shell` elasticDual Persistence via Startup and Scheduled Task elasticRegistry Modification via Microsoft Office elasticRegistry or File Modification from Suspicious Memory elasticRegistry Persistence via Microsoft Office Descendant Process elasticSuspicious Registry Modification via WMI elasticUncommon Persistence via Registry Modification elasticUncommon Registry Persistence Change	7	11
`TargetObject`	`wildcard`	`hkey_users\*\software\policies\microsoft\windows\system\scripts\logoff\script` elasticDual Persistence via Startup and Scheduled Task elasticRegistry Modification via Microsoft Office elasticRegistry or File Modification from Suspicious Memory elasticRegistry Persistence via Microsoft Office Descendant Process elasticSuspicious Registry Modification via WMI elasticUncommon Persistence via Registry Modification elasticUncommon Registry Persistence Change	7	11
`TargetObject`	`wildcard`	`hkey_users\*\software\policies\microsoft\windows\system\scripts\logon\script` elasticDual Persistence via Startup and Scheduled Task elasticRegistry Modification via Microsoft Office elasticRegistry or File Modification from Suspicious Memory elasticRegistry Persistence via Microsoft Office Descendant Process elasticSuspicious Registry Modification via WMI elasticUncommon Persistence via Registry Modification elasticUncommon Registry Persistence Change	7	11
`TargetObject`	`wildcard`	`hkey_users\*\software\policies\microsoft\windows\system\scripts\shutdown\script` elasticDual Persistence via Startup and Scheduled Task elasticRegistry Modification via Microsoft Office elasticRegistry or File Modification from Suspicious Memory elasticRegistry Persistence via Microsoft Office Descendant Process elasticSuspicious Registry Modification via WMI elasticUncommon Persistence via Registry Modification elasticUncommon Registry Persistence Change	7	11
`TargetObject`	`wildcard`	`hkey_users\*\software\policies\microsoft\windows\system\scripts\startup\script` elasticDual Persistence via Startup and Scheduled Task elasticRegistry Modification via Microsoft Office elasticRegistry or File Modification from Suspicious Memory elasticRegistry Persistence via Microsoft Office Descendant Process elasticSuspicious Registry Modification via WMI elasticUncommon Persistence via Registry Modification elasticUncommon Registry Persistence Change	7	11
`process.code_signature.exists`	`eq`	`false` elasticBrowser Native Messaging Registry Modification elasticDefense Evasion via Registry Modification elasticPotential AutoConfigURL Settings Hijack elasticRemcos RAT INETCookies File Deletion elasticSuspicious Browser Files Modification elasticSuspicious Windows Defender Registry Modification elasticUncommon Persistence via Registry Modification elasticUser Account Control Disabled via Registry	8	119
`process.code_signature.trusted`	`eq`	`false` elasticBrowser Native Messaging Registry Modification elasticPotential AutoConfigURL Settings Hijack elasticRemcos RAT INETCookies File Deletion elasticSuspicious Browser Files Modification elasticSuspicious Windows Defender Registry Modification elasticUncommon Persistence via Registry Modification elasticUser Account Control Disabled via Registry	7	115
`process_name`	`eq`	`powershell.exe` elasticDefense Evasion via Registry Modification elasticFile or Directory Deletion Command elasticPotential AutoConfigURL Settings Hijack elasticSuspicious Shell Extension Handler Registry Modification elasticSuspicious Windows Defender Registry Modification elasticUncommon Persistence via Registry Modification	6	184
`process_name`	`eq`	`rundll32.exe` elasticFile or Directory Deletion Command elasticSuspicious Shell Extension Handler Registry Modification elasticSuspicious Windows Defender Registry Modification elasticUncommon Persistence via Registry Modification elasticUser Account Control Disabled via Registry splunkRundll32 Shimcache Flush	6	126

Exclusions (647 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`process.code_signature.trusted`	`eq`	`true` elasticAttempt to Hide Files via Registry Modification elasticComponent Object Model Hijacking elasticDefense Evasion via Registry Modification elasticRegistry Modification via WMI StdRegProv elasticRegistry or File Modification from Suspicious Memory elasticRegistry Persistence via Microsoft Office Descendant Process elasticShadow Copy Service Disabled via Registry Modification elasticSuspicious BootExecute Registry Modification elasticSuspicious MS Office Execution via DCOM elasticSuspicious Registry Symbolic Link elasticSuspicious Windows Authentication Registry Modification elasticUAC Bypass via DelegateExecute Registry Modification elasticUnusual Windows System Service Disabled	13
`user.id`	`eq`	`s-1-5-18` elasticBrowser Native Messaging Registry Modification elasticDefense Evasion via Registry Modification elasticFile or Directory Deletion Command elasticFull User-Mode Dumps Enabled System-Wide elasticModification of WDigest Security Provider elasticPotential RemoteMonologue Attack elasticService Disabled via Registry Modification elasticStartup or Run Key Registry Modification elasticSuspicious NullSessionPipe Registry Modification elasticUncommon Persistence via Registry Modification elasticUser Account Control Disabled via Registry elasticWaaSMedicSvc COM Type Lib Hijack elasticWindows Defender Disabled via Registry Modification	13
`user.id`	`eq`	`s-1-5-19` elasticBrowser Native Messaging Registry Modification elasticDefense Evasion via Registry Modification elasticFull User-Mode Dumps Enabled System-Wide elasticStartup or Run Key Registry Modification elasticSuspicious NullSessionPipe Registry Modification elasticUncommon Persistence via Registry Modification elasticUser Account Control Disabled via Registry	7
`user.id`	`eq`	`s-1-5-20` elasticDefense Evasion via Registry Modification elasticFull User-Mode Dumps Enabled System-Wide elasticStartup or Run Key Registry Modification elasticSuspicious NullSessionPipe Registry Modification elasticUncommon Persistence via Registry Modification elasticUser Account Control Disabled via Registry	6
`Image`	`wildcard`	`?:\program files\*.exe` elasticBrowser Native Messaging Registry Modification elasticComponent Object Model Hijacking elasticRegistry or File Modification from Suspicious Memory elasticService Path Modification elasticSuspicious Browser Files Modification elasticSuspicious MS Office Execution via DCOM elasticSuspicious NullSessionPipe Registry Modification elasticSuspicious Registry Symbolic Link elasticSuspicious Windows Authentication Registry Modification elasticUAC Bypass via DelegateExecute Registry Modification elasticUnusual Persistence via Services Registry	11
`Image`	`wildcard`	`?:\windows\system32\svchost.exe` elasticCode Signing Policy Modification Through Registry elasticComponent Object Model Hijacking elasticDisabling Hypervisor-protected Code Integrity via Registry elasticMicrosoft Windows Defender Tampering elasticPowerShell Script Block Logging Disabled elasticRDP Enabled via Registry elasticSuspicious NullSessionPipe Registry Modification elasticSuspicious Registry Symbolic Link elasticSuspicious Scheduled Task Registry Modification elasticUnusual Persistence via Services Registry	10
`Image`	`wildcard`	`?:\program files (x86)\*.exe` elasticComponent Object Model Hijacking elasticRegistry or File Modification from Suspicious Memory elasticService Path Modification elasticSuspicious MS Office Execution via DCOM elasticSuspicious NullSessionPipe Registry Modification elasticSuspicious Registry Symbolic Link elasticSuspicious Windows Authentication Registry Modification elasticUAC Bypass via DelegateExecute Registry Modification elasticUnusual Persistence via Services Registry	9
`Image`	`wildcard`	`?:\windows\system32\msiexec.exe` elasticComponent Object Model Hijacking elasticRegistry Persistence via AppInit DLL elasticStartup or Run Key Registry Modification elasticSuspicious NullSessionPipe Registry Modification elasticSuspicious Windows Authentication Registry Modification elasticUnusual Persistence via Services Registry	6
`Image`	`wildcard`	`\device\harddiskvolume*\windows\system32\svchost.exe` elasticCode Signing Policy Modification Through Registry elasticMicrosoft Windows Defender Tampering elasticPowerShell Script Block Logging Disabled elasticRDP Enabled via Registry elasticSuspicious Scheduled Task Registry Modification	5
`Image`	`wildcard`	`?:\program files (x86)\*` elasticBrowser Native Messaging Registry Modification elasticPotential AutoConfigURL Settings Hijack elasticSuspicious Browser Files Modification elasticUntrusted Process Writing to Commonly Abused Persistence Locations	4
`Image`	`eq`	`?:\windows\system32\svchost.exe` elasticCrashDump Disabled via Registry Modification elasticFull User-Mode Dumps Enabled System-Wide elasticModification of WDigest Security Provider elasticUnusual Startup Shell Folder Modification elasticWaaSMedicSvc COM Type Lib Hijack elasticWindows Defender Disabled via Registry Modification	6
`Image`	`eq`	`?:\windows\system32\services.exe` elasticShadow Copy Service Disabled via Registry Modification elasticSuspicious Windows Authentication Registry Modification elasticWindows Defender Disabled via Registry Modification	3
`Details`	`eq`	`(empty)` sigmaModification of IE Registry Settings sigmaPotential Persistence Via Event Viewer Events.asp sigmaPotentially Suspicious Desktop Background Change Via Registry elasticNullSessionPipe Registry Modification	4
`Image`	`starts_with`	`c:\program files\` sigmaAccess To .Reg/.Hive Files By Uncommon Applications sigmaPotential Persistence Via Custom Protocol Handler sigmaPotentially Suspicious Image Load of Offreg.dll sigmaRemoval of Potential COM Hijacking Registry Keys	4
`Image`	`ends_with`	`\officeclicktorun.exe` sigmaMicrosoft Office Trusted Location Updated sigmaPotential Persistence Via Outlook Today Page sigmaUncommon Microsoft Office Trusted Location Added	3

Modify Registry `T1112`

Events covered

Authoring guide

Fields filtered most (70 distinct)

Top indicator values (1373 distinct)

Exclusions (647 distinct)

Rules under this technique

Sigma 98 rules

Elastic 93 rules

Splunk 107 rules

Kusto 1 rule

YARA-L 8 rules

Modify Registry T1112

Events covered

Authoring guide

Fields filtered most (70 distinct)

Top indicator values (1373 distinct)

Exclusions (647 distinct)

Rules under this technique

Sigma 98 rules

Elastic 93 rules

Splunk 107 rules

Kusto 1 rule

YARA-L 8 rules

Modify Registry `T1112`