Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1112

Modify Registry

Defense ImpairmentPersistence 218 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
sigma Registry Tampering Of Internal Tools Settings experimental 2026-10-18
sigma Disable Internal Tools or Feature in Registry test 2026-10-18
splunk Enable WDigest UseLogonCredential Registry production 2026-10-09
splunk Suspicious Reg exe Process production 2026-10-09
splunk Windows Outlook WebView Registry Modification production 2026-10-09
elastic Microsoft Windows Defender Tampering production 2026-10-07
elastic Port Forwarding Rule Addition production 2026-10-06
elastic SolarWinds Process Disabling Services via Registry production 2026-10-06
elastic Startup or Run Key Registry Modification production 2026-10-05
splunk Windows Modify Registry No Auto Reboot With Logon User production 2026-10-02
splunk Windows Modify Registry MaxConnectionPerServer production 2026-10-02
splunk Windows Modify Registry LongPathsEnabled production 2026-10-02
splunk Windows Modify Registry EnableLinkedConnections production 2026-10-02
splunk Windows Modify Registry DontShowUI production 2026-10-02
splunk Windows Modify Registry Do Not Connect To Win Update production 2026-10-02
splunk Windows Modify Registry DisAllow Windows App production 2026-10-02
splunk Windows Modify Registry DisableSecuritySettings production 2026-10-02
splunk Windows Modify Registry DisableRemoteDesktopAntiAlias production 2026-10-02
splunk Windows Modify Registry Disable Windows Security Center Notif production 2026-10-02
splunk Windows Modify Registry Disable WinDefender Notifications production 2026-10-02
splunk Windows Modify Registry Disable Win Defender Raw Write Notif production 2026-10-02
splunk Windows Modify Registry Disable Toast Notifications production 2026-10-02
splunk Windows Modify Registry Disable RDP production 2026-10-02
splunk Windows Modify Registry Auto Update Notif production 2026-10-02
splunk Windows Modify Registry AuthenticationLevelOverride production 2026-10-02
splunk Windows Disable Windows Group Policy Features Through Registry production 2026-10-02
splunk Windows Disable Shutdown Button Through Registry production 2026-10-02
splunk Windows Disable Notification Center production 2026-10-02
splunk Windows Disable LogOff Button Through Registry production 2026-10-02
splunk Windows Disable Lock Workstation Feature Through Registry production 2026-10-02
splunk Windows Disable Change Password Through Registry production 2026-10-02
splunk FodHelper UAC Bypass production 2026-10-02
splunk Disabling CMD Application production 2026-10-02
splunk Disable Registry Tool production 2026-10-02
splunk Windows Modify Registry Disabling WER Settings production 2026-10-02
splunk Windows Snake Malware Registry Modification wav OpenWithProgIds production 2026-10-02
splunk Windows Modify Show Compress Color And Info Tip Registry production 2026-10-02
splunk Windows Modify Registry Tamper Protection production 2026-10-02
splunk Windows Modify Registry Suppress Win Defender Notif production 2026-10-02
splunk Windows Modify Registry ProxyServer production 2026-10-02
splunk Windows Modify Registry ProxyEnable production 2026-10-02
splunk Windows Modify Registry on Smart Card Group Policy production 2026-10-02
splunk Windows Modify Registry No Auto Update production 2026-10-02
splunk Windows Defender ASR Rule Disabled production 2026-09-22
splunk Windows Defender ASR Registry Modification production 2026-09-22
elastic Outlook Home Page Registry Modification production 2026-09-18
elastic Potential Evasion via Boot Time Removal Tool production 2026-09-18
elastic Modification of AmsiEnable Registry Key production 2026-09-18
elastic Modification of WDigest Security Provider production 2026-09-18
elastic Full User-Mode Dumps Enabled System-Wide production 2026-09-18
elastic Privilege Escalation via Windir Environment Variable production 2026-09-18
elastic Potential Privilege Escalation via Service ImagePath Modification production 2026-09-18
elastic Suspicious Print Spooler Point and Print DLL production 2026-09-18
elastic Disabling User Account Control via Registry Modification production 2026-09-18
elastic Werfault ReflectDebugger Persistence production 2026-09-18
elastic Installation of Security Support Provider production 2026-09-18
elastic Persistence via Hidden Run Key Detected production 2026-09-18
elastic Potential Persistence via Mandatory User Profile production 2026-09-18
elastic Suspicious ImagePath Service Creation production 2026-09-18
elastic Component Object Model Hijacking production 2026-09-18
elastic Unusual Persistence via Services Registry production 2026-09-18
elastic Uncommon Registry Persistence Change production 2026-09-18
elastic Netsh Helper DLL production 2026-09-18
elastic Office Test Registry Persistence production 2026-09-18
elastic Suspicious Startup Shell Folder Modification production 2026-09-18
elastic Image File Execution Options Injection production 2026-09-18
elastic Registry Persistence via AppInit DLL production 2026-09-18
elastic RDP Enabled via Registry production 2026-09-18
elastic NullSessionPipe Registry Modification production 2026-09-18
elastic Windows Subsystem for Linux Distribution Installed production 2026-09-18
elastic Potential RemoteMonologue Attack production 2026-09-18
elastic DNS Global Query Block List Modified or Disabled production 2026-09-18
elastic Local Account TokenFilter Policy Disabled production 2026-09-18
elastic Potential NetNTLMv1 Downgrade Attack production 2026-09-18
elastic MS Office Macro Security Registry Modifications production 2026-09-18
elastic Disabling Lsa Protection via Registry Modification production 2026-09-18
elastic DNS-over-HTTPS Enabled via Registry production 2026-09-18
elastic PowerShell Script Block Logging Disabled production 2026-09-18
elastic Network-Level Authentication (NLA) Disabled production 2026-09-18
elastic Windows Defender Disabled via Registry Modification production 2026-09-18
elastic Code Signing Policy Modification Through Registry production 2026-09-18
elastic Potential Uninstall Entry Concealment production 2026-09-17
elastic Deprecated - Encoded Executable Stored in the Registry deprecated 2026-08-19
sigma Potentially Suspicious Image Load of Offreg.dll experimental 2026-07-23
sigma Registry Manipulation via WMI Stdregprov experimental 2026-06-19
splunk Windows Modify Registry Auto Minor Updates production 2026-05-13
splunk Disable Security Logs Using MiniNt Registry production 2026-05-13
splunk Disable Show Hidden Files production 2026-05-13
splunk Disable Windows App Hotkeys production 2026-05-13
splunk Disabling ControlPanel production 2026-05-13
splunk Disabling NoRun Windows App production 2026-05-13
splunk Malicious InProcServer32 Modification production 2026-05-13
splunk Remcos client registry install entry production 2026-05-13
splunk Revil Registry Entry production 2026-05-13
splunk Rundll32 Shimcache Flush production 2026-05-13
splunk Windows Anomalous Registry Value Length in Environment Key production 2026-05-13
splunk Windows Deleted Registry By A Non Critical Process File Path production 2026-05-13
splunk Windows Downdate Registry Activity production 2026-05-13
splunk Windows Hide Notification Features Through Registry production 2026-05-13
splunk Windows Impair Defenses Disable AV AutoStart via Registry production 2026-05-13
splunk Windows InProcServer32 New Outlook Form production 2026-05-13
splunk Windows Modify Registry Configure BitLocker production 2026-05-13
splunk Windows Modify Registry Default Icon Setting production 2026-05-13
splunk Windows Modify Registry Delete Firewall Rules production 2026-05-13
splunk Windows Modify Registry Disable Restricted Admin production 2026-05-13
splunk Windows Modify Registry NoChangingWallPaper production 2026-05-13
splunk Windows Modify Registry Qakbot Binary Data Registry production 2026-05-13
splunk Windows Modify Registry Regedit Silent Reg Import production 2026-05-13
splunk Windows Modify Registry Risk Behavior production 2026-05-13
splunk Windows Modify Registry to Add or Modify Firewall Rule production 2026-05-13
splunk Windows Modify Registry UpdateServiceUrlAlternate production 2026-05-13
splunk Windows Modify Registry USeWuServer production 2026-05-13
splunk Windows Modify Registry Utilize ProgIDs production 2026-05-13
splunk Windows Modify Registry ValleyRAT C2 Config production 2026-05-13
splunk Windows Modify Registry ValleyRat PWN Reg Entry production 2026-05-13
splunk Windows Modify Registry With MD5 Reg Key Name production 2026-05-13
splunk Windows Modify Registry WuServer production 2026-05-13
splunk Windows Modify Registry wuStatusServer production 2026-05-13
splunk Windows New InProcServer32 Added production 2026-05-13
splunk Windows Outlook Dialogs Disabled from Unusual Process production 2026-05-13
splunk Windows Outlook LoadMacroProviderOnBoot Persistence production 2026-05-13
splunk Windows Routing and Remote Access Service Registry Key Change production 2026-05-13
splunk Windows RunMRU Registry Key or Value Deleted production 2026-05-13
splunk Windows Set Network Profile Category to Private via Registry production 2026-05-13
splunk Windows SnappyBee Create Test Registry production 2026-05-13
sigma Suspicious WSL InstallLocation Registry Key Modification Via CommandLine experimental 2026-05-05
sigma Potential WSL InstallLocation Registry Key Modification experimental 2026-05-05
sigma Registry Tampering by Potentially Suspicious Processes experimental 2026-04-14
sigma Registry Modification of MS-settings Protocol Handler test 2026-01-24
sigma Registry Modification for OCI DLL Redirection experimental 2026-01-24
sigma User Shell Folders Registry Modification via CommandLine experimental 2026-01-05
sigma Potential Tampering With RDP Related Registry Keys Via Reg.EXE test 2025-11-22
sigma RDP Sensitive Settings Changed test 2025-11-22
sigma Potential NetWire RAT Activity - Registry test 2025-11-03
sigma Potential Ursnif Malware Activity - Registry test 2025-10-22
sigma Modification of IE Registry Settings test 2025-10-22
sigma Sysmon Channel Reference Deletion test 2025-10-22
sigma Blackbyte Ransomware Registry test 2025-10-21
sigma Potentially Suspicious Desktop Background Change Via Registry test 2025-10-17
sigma Removal of Potential COM Hijacking Registry Keys test 2025-10-07
sigma Service Binary in Suspicious Folder test 2025-10-07
sigma RestrictedAdminMode Registry Value Tampering - ProcCreation test 2025-08-28
sigma Windows Event Log Access Tampering Via Registry experimental 2025-08-16
sigma Registry Modification Attempt Via VBScript - PowerShell experimental 2025-08-13
sigma Registry Modification Attempt Via VBScript experimental 2025-08-13
sigma Security Event Logging Disabled via MiniNt Registry Key - Registry Set experimental 2025-04-09
sigma Security Event Logging Disabled via MiniNt Registry Key - Process experimental 2025-04-09
sigma NetNTLM Downgrade Attack - Registry test 2024-12-03
sigma Non-privileged Usage of Reg or Powershell test 2024-12-01
sigma RestrictedAdminMode Registry Value Tampering test 2024-08-23
sigma Potential Persistence Via Outlook Today Page test 2024-08-07
sigma Potential Persistence Via Outlook Home Page test 2024-08-07
sigma Potential Raspberry Robin Registry Set Internet Settings ZoneMap test 2024-07-31
sigma Access To .Reg/.Hive Files By Uncommon Applications test 2024-07-29
sigma Run Once Task Configuration in Registry test 2024-03-25
sigma CVE-2020-1048 Exploitation Attempt - Suspicious New Printer Ports - Registry test 2024-03-25
sigma Service Binary in User Controlled Folder test 2024-03-25
sigma FlowCloud Registry Markers test 2024-03-20
sigma Office Macros Warning Disabled test 2024-03-19
sigma Imports Registry Key From a File test 2024-03-13
sigma Imports Registry Key From an ADS test 2024-03-13
sigma Enable LM Hash Storage - ProcCreation test 2023-12-22
sigma Potentially Suspicious Desktop Background Change Using Reg.EXE test 2023-12-21
sigma Enable LM Hash Storage test 2023-12-15
sigma Uncommon Microsoft Office Trusted Location Added test 2023-09-29
sigma OceanLotus Registry Activity test 2023-09-28
sigma Disable Windows Security Center Notifications test 2023-08-17
sigma DHCP Callout DLL Installation test 2023-08-17
sigma Wdigest Enable UseLogonCredential test 2023-08-17
sigma Winlogon AllowMultipleTSSessions Enable test 2023-08-17
sigma DNS-over-HTTPS Enabled by Registry test 2023-08-17
sigma ETW Logging Disabled For rpcrt4.dll test 2023-08-17
sigma Macro Enabled In A Potentially Suspicious Document test 2023-08-17
sigma Outlook EnableUnsafeClientMailRules Setting Enabled - Registry test 2023-08-17
sigma Trust Access Disable For VBApplications test 2023-08-17
sigma NET NGenAssemblyUsageLog Registry Key Tamper test 2023-08-17
sigma ETW Logging Disabled For SCM test 2023-08-17
sigma Registry Hide Function from User test 2023-08-17
sigma ETW Logging Disabled In .NET Processes - Sysmon Registry test 2023-08-17
sigma New DNS ServerLevelPluginDll Installed test 2023-08-17
sigma PowerShell Logging Disabled Via Registry Key Tampering test 2023-08-17
sigma Activate Suppression of Windows Security Center Notifications test 2023-08-17
sigma Add DisallowRun Execution to Registry test 2023-08-17
sigma Microsoft Office Trusted Location Updated test 2023-08-17
sigma Blue Mockingbird - Registry test 2023-08-17
sigma CrashControl CrashDump Disabled test 2023-08-17
sigma ClickOnce Trust Prompt Tampering test 2023-08-17
sigma Allow RDP Remote Assistance Feature test 2023-08-17
sigma New BgInfo.EXE Custom WMI Query Registry Configuration test 2023-08-16
sigma New BgInfo.EXE Custom VBScript Registry Configuration test 2023-08-16
sigma New BgInfo.EXE Custom DB Path Registry Configuration test 2023-08-16
sigma Potential Persistence Via Custom Protocol Handler test 2023-05-12
sigma Potential Qakbot Registry Activity test 2023-03-13
sigma OilRig APT Schedule Task Persistence - System test 2023-03-08
sigma OilRig APT Schedule Task Persistence - Security test 2023-03-08
sigma OilRig APT Activity test 2023-03-08
sigma OilRig APT Registry Persistence test 2023-03-08
sigma Potential Persistence Via Event Viewer Events.asp test 2023-03-05
sigma Registry Modification Via Regini.EXE test 2023-02-08
sigma Suspicious Registry Modification From ADS Via Regini.EXE test 2023-02-08
sigma Terminal Server Client Connection History Cleared - Registry test 2023-02-08
sigma Potential Suspicious Registry File Imported Via Reg.EXE test 2023-02-05
sigma New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE test 2023-02-05
sigma Change User Account Associated with the FAX Service test 2022-12-30
sigma Change the Fax Dll test 2022-12-30
sigma ETW Logging Disabled In .NET Processes - Registry test 2022-12-20
sigma Run Once Task Execution as Configured in Registry test 2022-12-13
sigma RDP Sensitive Settings Changed to Zero test 2022-11-26
sigma Reg Add Suspicious Paths test 2022-10-10
sigma NetNTLM Downgrade Attack test 2022-10-09
sigma Blue Mockingbird test 2022-10-09
sigma Remote Registry Lateral Movement test 2022-01-01
sigma Wdigest CredGuard Registry Modification test 2021-11-27
sigma Registry Entries For Azorult Malware test 2021-11-27
sigma Disable Security Events Logging Adding Reg Key MiniNt test 2021-11-27
sigma RedMimicry Winnti Playbook Registry Manipulation test 2021-11-27
sigma Suspicious VBoxDrvInst.exe Parameters test 2021-11-27
sigma ShimCache Flush stable 2021-02-01