Modify Registry

What is Modify Registry?

“Modify Registry is documented as technique T1112 in MITRE ATT&CK® v19.1 under the Defense Evasion tactic. Detection requires visibility into XDR, SIEM telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Modify Registry activity. These methods apply across XDR, SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor high-value registry key modifications including security policy settings, Windows Defender configuration, audit policy keys, and network configuration settings that attackers commonly modify to weaken defenses.

2. 2

   Alert on processes writing binary data or encoded content to registry values in unusual locations, as malware frequently stores encrypted payloads in registry keys to avoid writing files to disk where they could be scanned.

3. 3

   Detect modifications to registry keys that control security-relevant OS behaviors including LSA protection settings, credential guard configuration, and Protected Users security settings that limit attack surface.

4. 4

   Monitor for registry key deletions in locations commonly used for forensic evidence including ShellBags, MUICache, UserAssist, and other activity tracking registry keys that attackers delete to remove evidence of their presence.

5. 5

   Track registry modifications through Sysmon Event ID 13 and Windows audit subcategory "Registry" events, correlating changes with the making process and user context to identify unauthorized modifications from unexpected sources.

Example Alerts

These realistic alert examples show what Modify Registry looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Modify Registry?

Detection centers on XDR, SIEM telemetry for the defense evasion phase of the attack. Monitor high-value registry key modifications including security policy settings, Windows Defender configuration, audit policy keys, and network configuration settings that attackers commonly modify to weaken defenses. Alert on processes writing binary data or encoded content to registry values in unusual locations, as malware frequently stores encrypted payloads in registry keys to avoid writing files to disk where they could be scanned.

What does a Modify Registry alert look like?

A representative XDR detection is "LSA Protection Disabled via Registry Modification" (critical severity): Registry modification detected: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL changed from 1 to 0, disabling LSASS protected process mode. This protection prevents credential dumping tools from reading LSASS memory. The modification was made by a process running with kernel privileges immediately after a suspicious driver was loaded, indicating the attacker disabled this protection specifically to enable subsequent credential dumping with Mimikatz or similar tools.

Which tools detect Modify Registry, and how can I practice?

Modify Registry (T1112) is best surfaced with XDR, SIEM telemetry, which exposes the defense evasion signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.