ATT&CK technique · T1112
Modify Registry
PersistenceDefense Impairment· seen in 4 CISA KEV exploits
Full description, procedures and detections on attack.mitre.org
Who uses it
ATT&CK groups and malware with this technique. Highlighted: in SecurityTabs news this month.
Weaknesses that lead here
Classes of exploited vulnerability that CTID maps to this technique.
- CWE-2501 KEV CVEExecution with Unnecessary PrivilegesSoftware runs with more privilege than it needs, so any flaw in it is a flaw with full power.
- CWE-2691 KEV CVEImproper Privilege ManagementPrivileges are assigned or dropped incorrectly, so a low-privileged foothold becomes administrator.
- CWE-4161 KEV CVEUse After FreeThe program keeps using memory after releasing it, so an attacker who controls what lands there next can hijack execution.
- CWE-771 KEV CVEImproper Neutralization of Special Elements used in a Command ('Command Injection')Input is pasted into a command without escaping, so attackers append commands of their own.
- CWE-781 KEV CVEImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Input reaches an operating-system shell, letting an attacker run any command the service can.
Controls that mitigate it (3)
NIST SP 800-53 rev5, grouped by family (CTID mapping).
AC · Access Control
CM · Configuration Management
SI · System and Information Integrity
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial.