# T1112 - Modify Registry

## Description from ATT&CK

> Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.
> 
> Access to specific areas of the Registry depends on account permissions, with some keys requiring administrator-level access. The built-in Windows command-line utility [Reg](https://attack.mitre.org/software/S0075) may be used for local or remote Registry modification.(Citation: Microsoft Reg) Other tools, such as remote access tools, may also contain functionality to interact with the Registry through the Windows API.
> 
> The Registry may be modified in order to hide configuration information or malicious payloads via [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027).(Citation: Unit42 BabyShark Feb 2019)(Citation: Avaddon Ransomware 2021)(Citation: Microsoft BlackCat Jun 2022)(Citation: CISA Russian Gov Critical Infra 2018) The Registry may also be modified to impair defenses, such as by enabling macros for all Microsoft Office products, allowing privilege escalation without alerting the user, increasing the maximum number of allowed outbound requests, and/or modifying systems to store plaintext credentials in memory.(Citation: CISA LockBit 2023)(Citation: Unit42 BabyShark Feb 2019)
> 
> The Registry of a remote system may be modified to aid in execution of files as part of lateral movement. It requires the remote Registry service to be running on the target system.(Citation: Microsoft Remote) Often [Valid Accounts](https://attack.mitre.org/techniques/T1078) are required, along with access to the remote system's [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) for RPC communication.
> 
> Finally, Registry modifications may also include actions to hide keys, such as prepending key names with a null character, which will cause an error and/or be ignored when read via [Reg](https://attack.mitre.org/software/S0075) or other utilities using the Win32 API.(Citation: Microsoft Reghide NOV 2006) Adversaries may abuse these pseudo-hidden keys to conceal payloads/commands used to maintain persistence.(Citation: TrendMicro POWELIKS AUG 2014)(Citation: SpectorOps Hiding Reg Jul 2017)

[Source](https://attack.mitre.org/techniques/T1112)

## Atomic Tests

- [Atomic Test #1: Modify Registry of Current User Profile - cmd](#atomic-test-1-modify-registry-of-current-user-profile---cmd)
- [Atomic Test #2: Modify Registry of Local Machine - cmd](#atomic-test-2-modify-registry-of-local-machine---cmd)
- [Atomic Test #3: Modify registry to store logon credentials](#atomic-test-3-modify-registry-to-store-logon-credentials)
- [Atomic Test #4: Use Powershell to Modify registry to store logon credentials](#atomic-test-4-use-powershell-to-modify-registry-to-store-logon-credentials)
- [Atomic Test #5: Add domain to Trusted sites Zone](#atomic-test-5-add-domain-to-trusted-sites-zone)
- [Atomic Test #6: Javascript in registry](#atomic-test-6-javascript-in-registry)
- [Atomic Test #7: Change Powershell Execution Policy to Bypass](#atomic-test-7-change-powershell-execution-policy-to-bypass)
- [Atomic Test #8: BlackByte Ransomware Registry Changes - CMD](#atomic-test-8-blackbyte-ransomware-registry-changes---cmd)
- [Atomic Test #9: BlackByte Ransomware Registry Changes - Powershell](#atomic-test-9-blackbyte-ransomware-registry-changes---powershell)
- [Atomic Test #10: Disable Windows Registry Tool](#atomic-test-10-disable-windows-registry-tool)
- [Atomic Test #11: Disable Windows CMD application](#atomic-test-11-disable-windows-cmd-application)
- [Atomic Test #12: Disable Windows Task Manager application](#atomic-test-12-disable-windows-task-manager-application)
- [Atomic Test #13: Disable Windows Notification Center](#atomic-test-13-disable-windows-notification-center)
- [Atomic Test #14: Disable Windows Shutdown Button](#atomic-test-14-disable-windows-shutdown-button)
- [Atomic Test #15: Disable Windows LogOff Button](#atomic-test-15-disable-windows-logoff-button)
- [Atomic Test #16: Disable Windows Change Password Feature](#atomic-test-16-disable-windows-change-password-feature)
- [Atomic Test #17: Disable Windows Lock Workstation Feature](#atomic-test-17-disable-windows-lock-workstation-feature)
- [Atomic Test #18: Activate Windows NoDesktop Group Policy Feature](#atomic-test-18-activate-windows-nodesktop-group-policy-feature)
- [Atomic Test #19: Activate Windows NoRun Group Policy Feature](#atomic-test-19-activate-windows-norun-group-policy-feature)
- [Atomic Test #20: Activate Windows NoFind Group Policy Feature](#atomic-test-20-activate-windows-nofind-group-policy-feature)
- [Atomic Test #21: Activate Windows NoControlPanel Group Policy Feature](#atomic-test-21-activate-windows-nocontrolpanel-group-policy-feature)
- [Atomic Test #22: Activate Windows NoFileMenu Group Policy Feature](#atomic-test-22-activate-windows-nofilemenu-group-policy-feature)
- [Atomic Test #23: Activate Windows NoClose Group Policy Feature](#atomic-test-23-activate-windows-noclose-group-policy-feature)
- [Atomic Test #24: Activate Windows NoSetTaskbar Group Policy Feature](#atomic-test-24-activate-windows-nosettaskbar-group-policy-feature)
- [Atomic Test #25: Activate Windows NoTrayContextMenu Group Policy Feature](#atomic-test-25-activate-windows-notraycontextmenu-group-policy-feature)
- [Atomic Test #26: Activate Windows NoPropertiesMyDocuments Group Policy Feature](#atomic-test-26-activate-windows-nopropertiesmydocuments-group-policy-feature)
- [Atomic Test #27: Hide Windows Clock Group Policy Feature](#atomic-test-27-hide-windows-clock-group-policy-feature)
- [Atomic Test #28: Windows HideSCAHealth Group Policy Feature](#atomic-test-28-windows-hidescahealth-group-policy-feature)
- [Atomic Test #29: Windows HideSCANetwork Group Policy Feature](#atomic-test-29-windows-hidescanetwork-group-policy-feature)
- [Atomic Test #30: Windows HideSCAPower Group Policy Feature](#atomic-test-30-windows-hidescapower-group-policy-feature)
- [Atomic Test #31: Windows HideSCAVolume Group Policy Feature](#atomic-test-31-windows-hidescavolume-group-policy-feature)
- [Atomic Test #32: Windows Modify Show Compress Color And Info Tip Registry](#atomic-test-32-windows-modify-show-compress-color-and-info-tip-registry)
- [Atomic Test #33: Windows Powershell Logging Disabled](#atomic-test-33-windows-powershell-logging-disabled)
- [Atomic Test #34: Windows Add Registry Value to Load Service in Safe Mode without Network](#atomic-test-34-windows-add-registry-value-to-load-service-in-safe-mode-without-network)
- [Atomic Test #35: Windows Add Registry Value to Load Service in Safe Mode with Network](#atomic-test-35-windows-add-registry-value-to-load-service-in-safe-mode-with-network)
- [Atomic Test #36: Disable Windows Toast Notifications](#atomic-test-36-disable-windows-toast-notifications)
- [Atomic Test #37: Disable Windows Security Center Notifications](#atomic-test-37-disable-windows-secu