T1112 — Modify Registry

Tactics: Defense Impairment, Persistence · Platforms: Windows

Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution. Access to specific areas of the Registry depends on account permissions, with some keys requiring administrator-level access. The built-in Windows…

Sigma detection rules (1)

T1112 Modify Registry

title: T1112 Modify Registry
id: e71a06ce-61a5-477f-b6ce-68f623059a11
description: 'Detection of Registry Modifications to Persistence, Defense-Evasion, and Macro-Security Keys (Run/RunOnce, IFEO Debugger values, Winlogon Shell/Userinit, Office macro-security settings). (Data Component: Windows Registry Key Modification; baseline tier: windows-eventid.) Tune using: RegistryKeyPathPatterns, ParentProcessAllowList, TimeWindow, SignatureCheck.'
references:
  - https://attack.mitre.org/techniques/T1112
author: Shahrukh Khan
date: 2026-02-15
license: MIT
tags:
  - attack.defense-impairment
  - attack.persistence
  - attack.t1112

logsource:
  category: registry_set
  product: windows
  service: sysmon

detection:
  selection_eventid:
    EventID:
      - '13'
      - '14'

  selection_run_keys:
    TargetObject|contains:
      - '\Software\Microsoft\Windows\CurrentVersion\Run\'
      - '\Software\Microsoft\Windows\CurrentVersion\RunOnce\'
      - '\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\'

  selection_ifeo:
    TargetObject|contains: '\Image File Execution Options\'
    TargetObject|endswith: '\Debugger'

  selection_winlogon:
    TargetObject|contains:
      - '\Winlogon\Shell'
      - '\Winlogon\Userinit'

  selection_office_macros:
    TargetObject|contains:
      - '\Security\AccessVBOM'
      - '\Security\VBAWarnings'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection_eventid and (selection_run_keys or selection_ifeo or selection_winlogon or selection_office_macros) and not filter_system_account

falsepositives:
  - Legitimate software installers registering Run/RunOnce autostart entries, IT-managed IFEO debugger configuration, or admin-driven Office macro-security policy changes via GPO.

level: medium

Explore