Sign In
- Platform
- Solutions
- Modern NDR
- Resources
- Company
Platform
Modern NDR
Resources
Platform
Modern NDR
Resources
DETECTION OVERVIEW
Risk Factors
The Windows registry is a common target for attackers because modifying registry entries on a Windows device gives the attacker powerful capabilities to escalate privileges or maintain a persistent attack. Enumerating Windows registry information can be easily done with attack tools. While enumeration activity does not negatively affect a network, this activity should be examined before it potentially enables critical and costly attacks.
The system might change the risk score for this detection.
Kill Chain
Risk Score
37
After infiltrating a network, an attacker might try to enumerate information about potential target devices, such as operating system information. Enumerating Windows registry keys can help the attacker learn how to manipulate the operating system on a target device. Every Windows device has a Windows registry, which is a built-in hierarchical database that contains configuration data in the form of key-value pairs. One method for finding keys is to remotely query the Windows registry over the Windows Remote Registry (WINREG) interface. The attacker sends an API operation within a Microsoft remote procedure call (MSRPC) request to WINREG, and then retrieves a list of subkeys associated with a given key. Overall, this type of enumeration is a precursor to lateral movement, where the attacker compromises targets along an attack path to ultimately achieve their objective.
