T1112

Modify Registry

Defense Evasion Persistence Last updated:

Adversaries may interact with the Windows Registry to aid in defense evasion, persistence, and execution. The Registry may be modified to hide configuration information or malicious payloads, disable security controls (e.g., enabling WDigest plaintext credential caching, disabling Windows Defender, enabling Office macros), establish persistence via run keys or services, and store C2 configuration data. Common tools include the built-in reg.exe utility, PowerShell registry cmdlets (Set-ItemProperty, New-Item), and direct Win32 API calls (RegSetValueEx, RegCreateKeyEx). Adversaries may also target remote registries over SMB using valid accounts, or employ null-byte prefix tricks to create pseudo-hidden keys invisible to standard utilities.

What is T1112 Modify Registry?

Modify Registry (T1112) maps to the Defense Evasion and Persistence tactics — the adversary is trying to avoid being detected in MITRE ATT&CK.

This page provides production-ready detection logic for Modify Registry, covering the data sources and telemetry it touches: Windows Registry: Windows Registry Key Modification, Microsoft Defender for Endpoint, Process: Process Creation. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Defense Evasion Persistence
Technique
T1112 Modify Registry
Canonical reference
https://attack.mitre.org/techniques/T1112/
Microsoft Sentinel / Defender
kusto 
let SuspiciousPersistenceKeys = dynamic([
  "\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
  "\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce",
  "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",
  "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce",
  "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon",
  "\\SYSTEM\\CurrentControlSet\\Services",
  "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options"
]);
let DefenseEvasionKeys = dynamic([
  "\\SYSTEM\\CurrentControlSet\\Control\\Lsa",
  "\\SOFTWARE\\Policies\\Microsoft\\Windows Defender",
  "\\SOFTWARE\\Microsoft\\Windows Defender",
  "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System",
  "\\SOFTWARE\\Microsoft\\Office",
  "\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap"
]);
let SuspiciousProcesses = dynamic([
  "powershell.exe", "pwsh.exe", "cmd.exe", "wscript.exe", "cscript.exe",
  "mshta.exe", "rundll32.exe", "regsvr32.exe", "msbuild.exe", "wmic.exe",
  "certutil.exe", "bitsadmin.exe", "installutil.exe", "reg.exe"
]);
DeviceRegistryEvents
| where Timestamp > ago(24h)
| where ActionType in ("RegistryValueSet", "RegistryKeyCreated")
| where RegistryKey has_any (SuspiciousPersistenceKeys) or RegistryKey has_any (DefenseEvasionKeys)
| extend IsSuspiciousProcess = InitiatingProcessFileName in~ (SuspiciousProcesses)
| extend IsPersistenceKey = RegistryKey has_any (SuspiciousPersistenceKeys)
| extend IsDefenseEvasionKey = RegistryKey has_any (DefenseEvasionKeys)
| extend IsWDigestEnable = RegistryKey has "Lsa" and RegistryValueName =~ "UseLogonCredential" and RegistryValueData == "1"
| extend IsDefenderDisable = RegistryKey has "Windows Defender" and RegistryValueName =~ "DisableAntiSpyware" and RegistryValueData == "1"
| extend IsMacroEnable = RegistryKey has "\\Security" and RegistryValueName =~ "VBAWarnings" and RegistryValueData == "1"
| extend IsUACBypass = RegistryKey has "Policies\\System" and RegistryValueName =~ "EnableLUA" and RegistryValueData == "0"
| extend IsIFEO = RegistryKey has "Image File Execution Options" and RegistryValueName =~ "Debugger"
| extend IsWinlogonHijack = RegistryKey has "Winlogon" and RegistryValueName in~ ("Userinit", "Shell")
| project Timestamp, DeviceName, AccountName, ActionType,
         RegistryKey, RegistryValueName, RegistryValueData,
         InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName,
         IsPersistenceKey, IsDefenseEvasionKey, IsSuspiciousProcess,
         IsWDigestEnable, IsDefenderDisable, IsMacroEnable, IsUACBypass, IsIFEO, IsWinlogonHijack
| sort by Timestamp desc

Detects suspicious Windows Registry modifications using Microsoft Defender for Endpoint DeviceRegistryEvents. Covers key attack patterns: persistence via Run keys, Winlogon hijacking, and IFEO debugger injection; defense evasion via WDigest credential caching enablement, Windows Defender disabling, UAC bypass, and Office macro policy changes. Flags modifications initiated by common LOLBins and scripting interpreters. Each row is annotated with boolean flags identifying the specific attack pattern for analyst triage.

high severity medium confidence

Data Sources

Windows Registry: Windows Registry Key Modification Microsoft Defender for Endpoint Process: Process Creation

Required Tables

DeviceRegistryEvents

False Positives

  • Software installation and update processes legitimately modify Run keys and service registry entries — filter by known installer parent processes (msiexec.exe, setup.exe with code-signed paths)
  • Group Policy application (gpsvc, gpscript.exe) modifies Defender and Office macro policy keys during scheduled policy refreshes
  • System administrators using reg.exe or PowerShell to apply configuration baselines as part of hardening scripts
  • Endpoint management agents (SCCM, Intune, Tanium) that configure system settings via registry modifications during software deployment
  • Antivirus and EDR products that legitimately modify Windows Defender registry keys during updates or configuration changes

Sigma rule & cross-platform mapping

The detection logic for Modify Registry (T1112) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1112 Sigma rules on detection.fyi

Platform-specific guides for T1112

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-18 Research depth: deep
References (11)

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Add Persistence via Run Key using reg.exe

    Expected signal: Sysmon Event ID 13 (RegistryEvent - Value Set): TargetObject=HKCU\Software\Microsoft\Windows\CurrentVersion\Run\df00tech_test, Details=C:\Windows\System32\cmd.exe /c echo persistence_test, Image=C:\Windows\System32\reg.exe. Sysmon Event ID 1 (Process Create): Image=reg.exe with CommandLine showing add and Run key path. Security Event ID 4657 if SACL auditing is configured on the Run key.

  2. Test 2Enable WDigest Plaintext Credential Caching

    Expected signal: Sysmon Event ID 13: TargetObject=HKLM\SYSTEM\CurrentControlSet\Control\Lsa\UseLogonCredential, Details=DWORD (0x00000001), Image=C:\Windows\System32\reg.exe. Security Event ID 4657 (if SACL configured on LSA key): OldValue=0 or empty, NewValue=1. Process creation event for reg.exe with the full command line visible.

  3. Test 3Disable Windows Defender via Registry

    Expected signal: Sysmon Event ID 13: TargetObject=HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware, Details=DWORD (0x00000001). If Tamper Protection is active: Windows Defender Event ID 5001 (Real-time protection disabled) or Event ID 5013 (Tamper protection blocked change) in Microsoft-Windows-Windows Defender/Operational log. Process creation: reg.exe with DisableAntiSpyware in command line.

  4. Test 4IFEO Debugger Injection for Sticky Keys Backdoor

    Expected signal: Sysmon Event ID 13: TargetObject=HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger, Details=C:\Windows\System32\cmd.exe, Image=reg.exe. Sysmon Event ID 1 for reg.exe with full command line. If the backdoor is triggered: Sysmon Event ID 1 showing sethc.exe spawning cmd.exe from the winlogon.exe parent context.

Response Playbook

Triage

  1. Identify the exact registry key and value modified — cross-reference against the high-risk categories: WDigest (HKLM\SYSTEM\CurrentControlSet\Control\Lsa\UseLogonCredential=1), Defender disable (HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware=1), Winlogon hijack (HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit or Shell values altered), IFEO debugger injection (HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<target>.exe\Debugger), and UAC bypass (HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA=0)
  2. Determine the initiating process — what spawned the process that made the registry change? Run key persistence added by msiexec.exe from a known installer path is likely benign; the same key added by powershell.exe spawned from winword.exe is a critical indicator
  3. Check the user context — is the account a standard user, local admin, or domain admin? Registry modifications to HKLM paths require elevation; unexpected privilege use is a red flag
  4. Review the timing — does the registry modification coincide with a software deployment window, patch Tuesday, or GP refresh cycle? Check change management records for authorized work
  5. Query process history on the host around the event timestamp — did the modifying process execute any child processes, make network connections, or write files to disk? Use: DeviceProcessEvents | where DeviceName == '<host>' and Timestamp between (<T-5m>..<T+5m>)
  6. For Winlogon or IFEO modifications: immediately check current registry values on the live host using: reg query 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' — compare against your baseline

Containment

  1. WDigest enabled (UseLogonCredential=1): Force an immediate password reset for all interactive accounts that have logged on since the modification — their credentials may have been harvested from LSASS memory. Revert the key: reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v UseLogonCredential /t REG_DWORD /d 0 /f
  2. Windows Defender disabled via registry: Immediately push a GPO or Intune policy to re-enable real-time protection and restore policy keys. Consider the host potentially unprotected from the modification time onward — review all process executions and file creations in that window
  3. Winlogon Userinit or Shell hijacked: The host may execute arbitrary code at every logon. Do NOT allow additional users to log on to the host. Isolate immediately via EDR network isolation. Revert Userinit to: C:\Windows\system32\userinit.exe, and Shell to: explorer.exe
  4. IFEO Debugger injection: Identify the targeted executable (the key name) — this is a well-known persistence/privilege escalation vector (e.g., sethc.exe, utilman.exe for sticky-keys backdoor). Remove the Debugger value and investigate whether the backdoor was accessed
  5. Run key persistence: Remove the malicious Run key value, then hunt for the payload file path referenced in the value data. Quarantine the file and block its hash across the environment
  6. If any high-confidence malicious modification is confirmed: isolate the host, disable the affected user account, and initiate IR procedures

Evidence Collection

  1. Windows Security Event ID 4657 (A registry value was modified) — requires SACL auditing enabled on the target key. Captures: SubjectUserName, ProcessName, ObjectName (key path), ObjectValueName, OldValue, NewValue
  2. Sysmon Event ID 13 (RegistryEvent - Value Set) — captures TargetObject (full registry path), Details (new value data), Image (process path), User — no SACL configuration required
  3. Sysmon Event ID 12 (RegistryEvent - Object Create/Delete) — captures key creation and deletion events with the creating process context
  4. Sysmon Event ID 14 (RegistryEvent - Key/Value Rename) — captures rename operations used in pseudo-hidden key creation (null-byte prefix technique)
  5. Live registry snapshot: reg export HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\temp\run_keys.reg — preserve current state before remediation
  6. Timeline correlation: extract all process creation events (Sysmon EID 1 or Security EID 4688) for the initiating process PID in the 60 seconds before/after the registry modification
  7. File system artifacts: if the registry value contains a file path, collect the referenced file, its creation timestamp (Sysmon EID 11), and hash for malware analysis
  8. Memory artifacts: if WDigest was enabled, perform a memory acquisition for LSASS process — credentials may be recoverable post-mortem. Use WinPmem or DumpIt on an isolated host

Escalation Criteria

  • ! WDigest UseLogonCredential set to 1 — indicates deliberate credential harvesting preparation; escalate immediately as domain credentials may be at risk
  • ! Winlogon Userinit or Shell values modified to include an additional executable path — active backdoor persistence that executes on every logon; treat as confirmed compromise
  • ! IFEO Debugger set on an accessibility binary (sethc.exe, utilman.exe, osk.exe, narrator.exe, magnify.exe) — classic sticky-keys backdoor for SYSTEM-level shell without authentication
  • ! Windows Defender or security product disabled via registry by a non-admin or automated process with no change ticket — active defense evasion indicating attacker awareness of security tools
  • ! Registry modification initiated by an Office application (winword.exe, excel.exe, powerpnt.exe) or browser process — indicates macro-based or browser-exploit initial access leading to persistence
  • ! Same registry modification pattern observed across multiple endpoints within a short time window — potential lateral movement, worm propagation, or domain-wide GPO abuse

Investigation Guide

Forensic Artifacts

  • > Windows Event Log: Security — Event ID 4657 (Registry value modified), requires SACL auditing; Event ID 4656 (Registry handle requested); Event ID 4663 (Registry object access attempted)
  • > Windows Event Log: Microsoft-Windows-Sysmon/Operational — Event IDs 12, 13, 14 for registry create/set/rename operations with process context
  • > Registry hive files: HKLM maps to SYSTEM (C:\Windows\System32\config\SYSTEM), SOFTWARE (C:\Windows\System32\config\SOFTWARE); HKCU maps to NTUSER.DAT (C:\Users\<user>\NTUSER.DAT)
  • > Registry transaction log files: *.LOG1, *.LOG2 files alongside hive files — contain uncommitted registry transactions, useful for recovering recently made changes
  • > Prefetch: C:\Windows\Prefetch\REG.EXE-*.pf — confirms reg.exe execution timestamps and loaded DLLs
  • > AmCache.hve: C:\Windows\AppCompat\Programs\Amcache.hve — records first execution of reg.exe and other registry-modifying tools
  • > ShimCache (AppCompatCache): HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache — execution history of reg.exe and PowerShell
  • > USN Journal: $UsnJrnl on the system volume — tracks file system changes that may correlate with registry-based payload deployment
  • > NTUSER.DAT transaction logs: C:\Users\<user>\NTUSER.DAT.LOG* — recent HKCU changes recoverable even if hive was flushed

Tuning Guidance

Registry modification detection has a high baseline false positive rate in most environments due to constant software updates, GP refreshes, and endpoint management. Start by building a process allowlist: identify all legitimate processes that modify sensitive registry keys in your environment (msiexec.exe, gpscript.exe, your EDR agent, SCCM ccmexec.exe) and exclude them from alerting when modifying expected key paths. For Run key monitoring, require that the modification comes from a non-standard parent process AND the value data references a suspicious path or LOLBin — this two-condition approach dramatically reduces noise. For WDigest and Defender key monitoring, apply zero-tolerance: any modification to UseLogonCredential or DisableAntiSpyware should alert regardless of source, as legitimate changes are rare and always change-managed. Enable Sysmon Event ID 13 registry value set logging with targeted filters on the high-value key paths rather than global monitoring — global registry logging is extremely high volume and will saturate your SIEM. If using Security Event ID 4657, configure SACLs only on the highest-value keys (Lsa, Winlogon, Image File Execution Options) to limit volume. Finally, tune on RegistryValueData content for Run key alerts: allowlist known-good program paths by hash or signature rather than path alone, since attackers frequently place malicious binaries in paths that mimic legitimate software directories.

Hunting Queries

Hunt for registry modification bursts — processes writing more than 20 registry values within a 1-minute window. This pattern is characteristic of ransomware (e.g., Netwalker, SynAck) enumerating and modifying multiple keys, or automated malware installing widespread persistence. High counts from unexpected processes (Office apps, browsers) are high-priority findings.

Hunting — KQL
kql 
DeviceRegistryEvents
| where Timestamp > ago(7d)
| where ActionType == "RegistryValueSet"
| summarize ModCount=count(), UniqueKeys=dcount(RegistryKey), FirstSeen=min(Timestamp), LastSeen=max(Timestamp)
  by InitiatingProcessFileName, InitiatingProcessCommandLine, DeviceName, bin(Timestamp, 1m)
| where ModCount > 20
| extend BurstRate=ModCount
| sort by BurstRate desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13
| bin _time span=1m
| stats count as ModCount, dc(TargetObject) as UniqueKeys, values(Image) as Processes by host, _time
| where ModCount > 20
| sort - ModCount

Hunt for large or Base64-encoded payloads stored in registry values under HKCU\Software — a fileless storage technique used by malware like Turla, ShadowPad, and Valak to store encrypted C2 configuration, shellcode, or full script payloads in the registry to avoid writing files to disk. Values over 200 characters with base64-like content in unexpected software keys are strongly suspicious.

Hunting — KQL
kql 
DeviceRegistryEvents
| where Timestamp > ago(7d)
| where ActionType == "RegistryValueSet"
| where RegistryKey has "\\Software\\"
| where RegistryValueData matches regex @"[A-Za-z0-9+/]{100,}={0,2}"
| extend DataLength=strlen(RegistryValueData)
| where DataLength > 200
| project Timestamp, DeviceName, AccountName, RegistryKey, RegistryValueName,
         RegistryValueData=substring(RegistryValueData, 0, 100), DataLength,
         InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by DataLength desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13
| eval DataLen=len(Details)
| where DataLen > 200
| eval LooksBase64=if(match(Details, "^[A-Za-z0-9+/]{100,}={0,2}$"), 1, 0)
| where match(TargetObject, "(?i)\\Software\\\\") AND LooksBase64=1
| table _time, host, User, TargetObject, DataLen, Image, CommandLine
| sort - DataLen

Hunt for suspicious Run key persistence pointing to LOLBins, network paths, or user-writable temp directories. Legitimate software installations use msiexec.exe or trusted system processes and reference Program Files paths. Persistence via LOLBins (PowerShell, rundll32) in temp directories is a strong indicator of malware dropper activity.

Hunting — KQL
kql 
DeviceRegistryEvents
| where Timestamp > ago(7d)
| where ActionType in ("RegistryValueSet", "RegistryKeyCreated")
| where RegistryKey has "\\CurrentVersion\\Run" or RegistryKey has "\\CurrentVersion\\RunOnce"
| where InitiatingProcessFileName !in~ ("msiexec.exe", "TrustedInstaller.exe", "svchost.exe", "explorer.exe")
| extend ValuePath=RegistryValueData
| extend IsLOLBin=RegistryValueData has_any ("powershell", "cmd.exe", "wscript", "cscript", "mshta", "rundll32", "regsvr32", "certutil", "bitsadmin")
| extend IsNetworkPath=RegistryValueData startswith "\\\\" or RegistryValueData has "http"
| extend IsTempPath=RegistryValueData has_any ("%TEMP%", "%APPDATA%", "%PUBLIC%", "\\Temp\\", "\\AppData\\")
| where IsLOLBin or IsNetworkPath or IsTempPath
| project Timestamp, DeviceName, AccountName, RegistryKey, RegistryValueName, RegistryValueData,
         InitiatingProcessFileName, IsLOLBin, IsNetworkPath, IsTempPath
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13
  TargetObject="*\\CurrentVersion\\Run*"
  NOT (Image="*\\msiexec.exe" OR Image="*\\TrustedInstaller.exe" OR Image="*\\svchost.exe" OR Image="*\\explorer.exe")
| eval IsLOLBin=if(match(Details, "(?i)(powershell|cmd\.exe|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin)"), 1, 0)
| eval IsTempPath=if(match(Details, "(?i)(%temp%|%appdata%|%public%|\\\\temp\\\\|\\\\appdata\\\\)"), 1, 0)
| eval IsNetworkPath=if(match(Details, "(?i)(\\\\\\\\|http)"), 1, 0)
| where IsLOLBin=1 OR IsTempPath=1 OR IsNetworkPath=1
| table _time, host, User, TargetObject, Details, Image, IsLOLBin, IsTempPath, IsNetworkPath
| sort - _time

Atomic Red Team Tests

Test 1 Add Persistence via Run Key using reg.exe
windows

Creates a new registry value under HKCU Run key pointing to cmd.exe, simulating malware establishing user-context persistence. This is the most common registry-based persistence pattern, used by malware families including Conficker, Valak, and numerous RATs. The HKCU path requires no elevation, making it accessible to standard users.

Command

powershell 
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "df00tech_test" /t REG_SZ /d "C:\Windows\System32\cmd.exe /c echo persistence_test" /f

Cleanup

powershell 
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "df00tech_test" /f

Expected Telemetry

Sysmon Event ID 13 (RegistryEvent - Value Set): TargetObject=HKCU\Software\Microsoft\Windows\CurrentVersion\Run\df00tech_test, Details=C:\Windows\System32\cmd.exe /c echo persistence_test, Image=C:\Windows\System32\reg.exe. Sysmon Event ID 1 (Process Create): Image=reg.exe with CommandLine showing add and Run key path. Security Event ID 4657 if SACL auditing is configured on the Run key.

Expected Detection

KQL: ActionType=RegistryValueSet, RegistryKey contains CurrentVersion\Run, InitiatingProcessFileName=reg.exe — IsPersistenceKey flag set. SPL: EventCode=13, TargetObject matches CurrentVersion\Run, IsPersistenceKey=1, RiskScore >= 1.

Test 2 Enable WDigest Plaintext Credential Caching
windows

Sets UseLogonCredential to 1 in the LSA registry key, enabling WDigest authentication which causes Windows to cache plaintext credentials in LSASS memory. This technique, used by threat actors including SLOTHFULMEDIA and various APT groups, allows subsequent credential dumping via tools like Mimikatz to retrieve cleartext passwords. Requires administrator privileges. IMPORTANT: Revert immediately after testing — this leaves the system in a degraded security state.

Command

powershell 
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v "UseLogonCredential" /t REG_DWORD /d 1 /f

Cleanup

powershell 
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v "UseLogonCredential" /t REG_DWORD /d 0 /f

Expected Telemetry

Sysmon Event ID 13: TargetObject=HKLM\SYSTEM\CurrentControlSet\Control\Lsa\UseLogonCredential, Details=DWORD (0x00000001), Image=C:\Windows\System32\reg.exe. Security Event ID 4657 (if SACL configured on LSA key): OldValue=0 or empty, NewValue=1. Process creation event for reg.exe with the full command line visible.

Expected Detection

KQL: IsWDigestEnable flag=true, severity escalated automatically. SPL: IsWDigestEnable=1, RiskScore >= 3 (highest weighted score). This should be a zero-tolerance alert — escalate immediately per playbook.

Test 3 Disable Windows Defender via Registry
windows

Attempts to disable Windows Defender real-time protection by setting the DisableAntiSpyware registry value. This technique is used by ransomware (LockBit, Avaddon, BlackCat/ALPHV) and APT groups to disable endpoint protection before executing their payload. Note: Modern Windows versions with Tamper Protection enabled will block this change — the attempt itself (and subsequent Tamper Protection event) is valuable telemetry. Run as administrator.

Command

powershell 
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f

Cleanup

powershell 
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /f

Expected Telemetry

Sysmon Event ID 13: TargetObject=HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware, Details=DWORD (0x00000001). If Tamper Protection is active: Windows Defender Event ID 5001 (Real-time protection disabled) or Event ID 5013 (Tamper protection blocked change) in Microsoft-Windows-Windows Defender/Operational log. Process creation: reg.exe with DisableAntiSpyware in command line.

Expected Detection

KQL: IsDefenderDisable flag=true. SPL: IsDefenderDisable=1, RiskScore >= 3. Tamper Protection events may generate independent alerts from Windows Defender. Even a blocked attempt should be investigated.

Test 4 IFEO Debugger Injection for Sticky Keys Backdoor
windows

Injects a debugger entry under Image File Execution Options for sethc.exe (Sticky Keys), replacing it with cmd.exe. This is the classic accessibility feature backdoor technique — pressing Shift 5 times at the Windows login screen will spawn a SYSTEM-level command shell instead of Sticky Keys. Used by threat actors including APT groups for persistent privileged access. Requires administrator privileges. IMMEDIATELY revert after testing — this creates a serious security hole.

Command

powershell 
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v "Debugger" /t REG_SZ /d "C:\Windows\System32\cmd.exe" /f

Cleanup

powershell 
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f

Expected Telemetry

Sysmon Event ID 13: TargetObject=HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger, Details=C:\Windows\System32\cmd.exe, Image=reg.exe. Sysmon Event ID 1 for reg.exe with full command line. If the backdoor is triggered: Sysmon Event ID 1 showing sethc.exe spawning cmd.exe from the winlogon.exe parent context.

Expected Detection

KQL: IsIFEO flag=true, RegistryKey contains Image File Execution Options, RegistryValueName=Debugger. SPL: IsIFEO=1, RiskScore >= 2. Any Debugger value set under IFEO for system binaries (especially accessibility executables) should be treated as critical.

Related Detections

Tactic Hubs

TA0005Defense EvasionTA0003Persistence

Related Techniques

T1547.001Registry Run Keys / Startup FolderT1562.001Disable or Modify ToolsT1003.001LSASS MemoryT1546.008Accessibility FeaturesT1548.002Bypass User Account ControlT1027.011Fileless StorageT1543.003Windows ServiceT1059.001PowerShellT1021.002SMB/Windows Admin Shares

Same Tactic: Defense Evasion

Popular Detections