Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
The Registry contains a significant amount of information about the operating system, configuration, software, and security.(Citation: Wikipedia Windows Registry) Information can easily be queried using the Reg utility, though other means to access the Registry exist. Some of the information may help adversaries to further their operation within a network. Adversaries may use the information from Query Registry during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| intel-tdt | Intel Threat Detection Technology | CrowdStrike AMS | T1012 | Query Registry |
Comments
Intel Threat Detection Technology (TDT), combined with CrowdStrike Falcon Accelerated Memory Scanning (CAMS), enhances cybersecurity defenses by enabling faster, real-time detection of Query Registry attacks. This integrated solution strengthens CrowdStrike Falcon, improving its ability to detect and mitigate cyber threats earlier in the kill chain while minimizing system performance impact.
Query Registry attacks involve adversaries accessing and querying the Windows Registry to gather sensitive information or identify potential attack vectors. Attackers use the registry to collect system configuration details, credentials, software information, and other valuable data that may help in lateral movement, privilege escalation, or other malicious activities. Intel TDT plays a critical role in detecting these activities by providing real-time telemetry on program execution, memory access, and control flow, allowing rapid identification of abnormal behaviors such as unauthorized registry queries.
Additionally, CAMS offloads the performance-intensive task of memory scanning from the CPU to the Intel Integrated GPU, ensuring faster, more efficient detection of suspicious activity without degrading system performance. CAMS can identify malicious behaviors such as unauthorized registry access or attempts to extract sensitive data through registry queries, providing proactive defense against this form of reconnaissance.
References
|