Skip to content

Commit

Permalink
Merge pull request #1 from pjabes/patch-2
Browse files Browse the repository at this point in the history
fix: "whne" to "when"
  • Loading branch information
v3r5ace authored Nov 1, 2022
2 parents 615f898 + 7937879 commit 5e07c4d
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions Windows Registry/Highly Targeted Registry Keys.csv
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
Registry (Sub)Key Name,Importance Description,MITRE,Registry Operation,Recommended SACL,References
HKEY_CURRENT_USER\Environment\UserInitMprLogonScript,User logon scripts are used to establish persistence as they execute at logon initialization ,T1037.001,RegSetValue*,No,"Boot or Logon Initialization Scripts: Logon Script (Windows), Sub-technique T1037.001 - Enterprise | MITRE ATT&CK®"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run,"Used for persistence. HKCU - non-system user, will run whne the user logs in",T1547.001,RegSetValue*,No,https://labs.jumpsec.com/running-once-running-twice-pwned-windows-registry-run-keys/
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce,"Used for persistence. HKCU - non-system user, will run whne the user logs in. Removed after user logs in. ",T1547.001,RegSetValue*,No,https://labs.jumpsec.com/running-once-running-twice-pwned-windows-registry-run-keys/
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run,"Used for persistence. HKCU - non-system user, will run when the user logs in",T1547.001,RegSetValue*,No,https://labs.jumpsec.com/running-once-running-twice-pwned-windows-registry-run-keys/
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce,"Used for persistence. HKCU - non-system user, will run when the user logs in. Removed after user logs in. ",T1547.001,RegSetValue*,No,https://labs.jumpsec.com/running-once-running-twice-pwned-windows-registry-run-keys/
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run,"Used for persistence. HKLM - Admin/System user, will run everytime the machine boots",T1547.001,RegSetValue*,No,https://labs.jumpsec.com/running-once-running-twice-pwned-windows-registry-run-keys/
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce,"Used for persistence. HKLM - Admin/System user, will run when the machine boots and willl be removed after execution",T1547.001,RegSetValue*,No,https://labs.jumpsec.com/running-once-running-twice-pwned-windows-registry-run-keys/
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx,"Used for persistence. HKLM - Admin/System user, will run when the machine boots and willl be removed after execution",T1547.001,RegSetValue*,No,https://attack.mitre.org/techniques/T1547/001/
Expand Down

0 comments on commit 5e07c4d

Please sign in to comment.