T1112

Modify Registry

Windowsnothing on this site yetT1112 on attack.mitre.org

Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution. Access to specific areas of the Registry depends on account permissions, with some keys requiring administrator-level access. The built-in Windows command-line utility Reg may be used for local or remote Registry modification.
MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

Checklists and playbooks to open while the alert is still live.

Playbook for this stage

Suspicious execution on an endpoint

An EDR alert, an unexplained process, or a user reporting something odd.

Playbook for this stage

Ransomware, suspected or confirmed

Files renamed or unreadable, a ransom note, or backup deletion commands seen.

how MITRE says to see it

Behavior-Based Registry Modification Detection on Windows

Behavior chain involving abnormal registry modifications via CLI, PowerShell, WMI, or direct API calls, especially targeting persistence, privilege escalation, or defense evasion keys, potentially followed by service restart or process execution.

what reduces it

M1024 Restrict Registry Permissions. Ensure proper permissions are set for Registry hives to prevent users from modifying keys for system components that may lead to privilege escalation.

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.