create or modify Windows registry via WinAPI

[Ana06]

Rule name

create or modify Windows registry via WinAPI

Summary

Create Windows registry keys or values using the Windows API (WinAPI): https://docs.microsoft.com/en-us/windows/win32/sysinfo/registry-functions

Examples

Publicly available samples that contain the capability this rule should detect:

• PMA 03-02

References

Links or references to additional information on the capability (can also be included in the rule):

• Practical Malware Analysis
• https://docs.microsoft.com/en-us/windows/win32/sysinfo/registry-functions

Namespace

Proposed namespace: host-interaction/registry. More details in https://github.com/fireeye/capa-rules/blob/master/doc/format.md#rule-namespace

att&ck

aka.mitre.att&ck.t1012

[mr-tz]

see create or open registry key, set registry value, delete registry value?

[Ana06]

🙈