| Nature | Type | ID | Name |
|---|---|---|---|
| ChildOf | S | 203 | Manipulate Registry Information |
| CanFollow | S | 555 | Remote Services with Stolen Credentials |
| CanPrecede | S | 529 | Malware-Directed Internal Reconnaissance |
| CanPrecede | D | 568 | Capture Credentials via Keylogger |
| CanPrecede | S | 646 | Peripheral Footprinting |
Determine target system
The adversary must first determine the system they wish to target. This attack only works on Windows.
| Technique |
|---|
Gain access to the system
The adversary needs to gain access to the system in some way so that they can modify the Windows registry.
| Technique |
|---|
| Gain physical access to a system either through shoulder surfing a password or accessing a system that is left unlocked. |
| Gain remote access to a system through a variety of means. |
Modify Windows registry
The adversary will modify the Windows registry by adding a new entry to the "run keys" referencing a desired program. This program will be run whenever the user logs in.
| Technique |
|---|
| Scope | Likelihood | Impact | Note |
|---|---|---|---|
| Integrity | N/A | Modify DataGain Privileges | N/A |
| Taxonomy Name | Entry ID | Entry Name |
|---|---|---|
| ATTACK | 1547.001 | Boot or Logon Autostart Execution: Registry Run Keys / Start Folder |
| ATTACK | 1547.014 | Boot or Logon Autostart Execution: Active |