New Windows Registry Modification Attempt

$source sent a request to modify registry key values on a remote device. This is the first time in several weeks ExtraHop observed this activity. Check if the offender is authorized to change registry key values.

Every Windows device has a registry, which is a built-in hierarchical database that contains configuration data in the form of key-value pairs. This configuration data controls a number of critical processes, such as scripts that run at startup, initialization of security tools, and event logging. To change certain key values remotely, the attacker needs administrator privileges and access to the Remote Registry service on the target device. The attacker sends a Microsoft remote procedure call (MS-RPC) with commands to modify values of a specified key value. For example, the attacker can replace the value for the HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit key, which specifies scripts that run during system initiation. The new value includes the original string, but adds a path to malicious code.