Remote Registry Key Modifications

Description

This search monitors for remote modifications to registry keys.

Content Mapping

This content is not mapped to any local saved search. Add mapping


Use Case

Advanced Threat Detection

Category

Adversary Tactics

Alert Volume

This search monitors for remote modifications to registry keys.

SPL Difficulty

None

Journey

Stage 3

Kill Chain Phases

Actions On Objectives

Data Sources

Endpoint Detection and Response

   Help

Remote Registry Key Modifications Help

To successfully implement this search, you must populate the Endpoint data model. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.

   Search

Open in Search