Dark Mode
Capec-270 Detail
Modification of Registry Run Keys
Detailed Software Likelihood: Medium Typical Severity: Medium
Parents: 203
Threats: T62 T68
An adversary adds a new entry to the "run keys" in the Windows registry so that an application of their choosing is executed when a user logs in. In this way, the adversary can get their executable to operate and run on the target system with the authorized user's level of permissions. This attack is a good way for an adversary to run persistent spyware on a user's machine, such as a keylogger.
Not present
| External ID | Source | Link | Description |
|---|---|---|---|
| CAPEC-270 | capec | https://capec.mitre.org/data/definitions/270.html | |
| CWE-15 | cwe | http://cwe.mitre.org/data/definitions/15.html | |
| T1547.001 | ATTACK | https://attack.mitre.org/wiki/Technique/T1547/001 | Boot or Logon Autostart Execution: Registry Run Keys / Start Folder |
| T1547.014 | ATTACK | https://attack.mitre.org/wiki/Technique/T1547/014 | Boot or Logon Autostart Execution: Active |
Explore
-
Determine target system: The adversary must first determine the system they wish to target. This attack only works on Windows.
Experiment
-
Gain access to the system: The adversary needs to gain access to the system in some way so that they can modify the Windows registry.
| Techniques |
|---|
| Gain physical access to a system either through shoulder surfing a password or accessing a system that is left unlocked. |
| Gain remote access to a system through a variety of means. |
Exploit
-
Modify Windows registry: The adversary will modify the Windows registry by adding a new entry to the "run keys" referencing a desired program. This program will be run whenever the user logs in.
- The adversary must have gained access to the target system via physical or logical means in order to carry out this attack.
Not present
Not present
| Integrity |
|---|
| Modify Data |
| Gain Privileges |
- An adversary can place a malicious executable (RAT) on the target system and then configure it to automatically run when the user logs in to maintain persistence on the target system.
- Through the modification of registry "run keys" the adversary can masquerade a malicious executable as a legitimate program.