CAPEC-270 Modification of Registry Run Keys

An adversary adds a new entry to the "run keys" in the Windows registry so that an application of their choosing is executed when a user logs in. In this way, the adversary can get their executable to operate and run on the target system with the authorized user's level of permissions. This attack is a good way for an adversary to run persistent spyware on a user's machine, such as a keylogger.

1. [Explore] [Determine target system] The adversary must first determine the system they wish to target. This attack only works on Windows. 2. [Experiment] [Gain access to the system] The adversary needs to gain access to the system in some way so that they can modify the Windows registry. 3. [Exploit] [Modify Windows registry] The adversary will modify the Windows registry by adding a new entry to the "run keys" referencing a desired program. This program will be run whenever the user logs in.

• The adversary must have gained access to the target system via physical or logical means in order to carry out this attack.

• Integrity: Modify Data, Gain Privileges

• Identify programs that may be used to acquire process information and block them by using a software restriction policy or tools that restrict program execution by using a process allowlist.