CAPEC-270: Modification of Registry Run Keys
Description
An adversary adds a new entry to the run keys in the Windows registry so that an application of their choosing is executed when a user logs in. In this way, the adversary can get their executable to operate and run on the target system with the authorized user's level of permissions. This attack is a good way for an adversary to run persistent spyware on a user's machine, such as a keylogger.
- Likelihood of attack
- Medium
- Typical severity
- Medium
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Manipulate System Resources
Prerequisites
- The adversary must have gained access to the target system via physical or logical means in order to carry out this attack.
Consequences
- Integrity
Modify Data; Gain Privileges
Mitigations
- Identify programs that may be used to acquire process information and block them by using a software restriction policy or tools that restrict program execution by using a process allowlist.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
- T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1547.014Boot or Logon Autostart Execution: Active Setup
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-SICASystem Init Config Analysis1 shared
- D3-AVEAsset Vulnerability Enumeration1 shared
- D3-RSRestore Software1 shared
- D3-SWISoftware Inventory1 shared
- D3-SUSoftware Update1 shared
- D3-DADynamic Analysis1 shared
- D3-EFAEmulated File Analysis1 shared
- D3-CIConfiguration Inventory1 shared
- D3-RCRestore Configuration1 shared
- D3-EALExecutable Allowlisting1 shared
- D3-EDLExecutable Denylisting1 shared
- D3-CFContent Filtering1 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2021-11-002Registry Edit with Modification of Userinit, Shell or Notify1 shared
- CAR-2021-12-002Modification of Default Startup Folder in the Registry Key 'Common Startup'1 shared
- CAR-2013-03-001Reg.exe called from Command Shell1 shared
- CAR-2020-05-003Rare LolBAS Command Lines1 shared
- CAR-2013-01-002Autorun Differences1 shared