Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.

Access to specific areas of the Registry depends on account permissions, some requiring administrator-level access. The built-in Windows command-line utility [Reg](https://attack.mitre.org/software/S0075) may be used for local or remote Registry modification. (Citation: Microsoft Reg) Other tools may also be used, such as a remote access tool, which may contain functionality to interact with the Registry through the Windows API.

Registry modifications may also include actions to hide keys, such as prepending key names with a null character, which will cause an error and/or be ignored when read via [Reg](https://attack.mitre.org/software/S0075) or other utilities using the Win32 API. (Citation: Microsoft Reghide NOV 2006) Adversaries may abuse these pseudo-hidden keys to conceal payloads/commands used to maintain persistence. (Citation: TrendMicro POWELIKS AUG 2014) (Citation: SpectorOps Hiding Reg Jul 2017)

The Registry of a remote system may be modified to aid in execution of files as part of lateral movement. It requires the remote Registry service to be running on the target system. (Citation: Microsoft Remote) Often [Valid Accounts](https://attack.mitre.org/techniques/T1078) are required, along with access to the remote system's [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) for RPC communication.
Modify Registry
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1112  external_id: T1112     source_name: Microsoft Reg  description: Microsoft. (2012, April 17). Reg. Retrieved May 1, 2015.  url: https://technet.microsoft.com/en-us/library/cc732643.aspx     source_name: Microsoft Remote  description: Microsoft. (n.d.). Enable the Remote Registry Service. Retrieved May 1, 2015.  url: https://technet.microsoft.com/en-us/library/cc754820.aspx     source_name: Microsoft 4657 APR 2017  description: Miroshnikov, A. & Hall, J. (2017, April 18). 4657(S): A registry value was modified. Retrieved August 9, 2018.  url: https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4657     source_name: SpectorOps Hiding Reg Jul 2017  description: Reitz, B. (2017, July 14). Hiding Registry keys with PSReflect. Retrieved August 9, 2018.  url: https://posts.specterops.io/hiding-registry-keys-with-psreflect-b18ec5ac8353     source_name: Microsoft Reghide NOV 2006  description: Russinovich, M. & Sharkey, K. (2006, January 10). Reghide. Retrieved August 9, 2018.  url: https://docs.microsoft.com/sysinternals/downloads/reghide     source_name: Microsoft RegDelNull July 2016  description: Russinovich, M. & Sharkey, K. (2016, July 4). RegDelNull v1.11. Retrieved August 10, 2018.  url: https://docs.microsoft.com/en-us/sysinternals/downloads/regdelnull     source_name: TrendMicro POWELIKS AUG 2014  description: Santos, R. (2014, August 1). POWELIKS: Malware Hides In Windows Registry. Retrieved August 9, 2018.  url: https://blog.trendmicro.com/trendlabs-security-intelligence/poweliks-malware-hides-in-windows-registry/     