MalwareUsed by 1 actor

Reg

Reg is the Windows built-in command-line utility used to query, enumerate, and dump Windows Registry data on local or remote systems. In the provided content it is associated with adversarial use of the Registry for discovery and credential access, including gathering details from the Windows Registry and finding credentials stored there. The content specifically states that Daggerfly used Reg to dump the SAM, SYSTEM, and SECURITY registry hives from victim machines. More broadly, the referenced activity aligns with querying Registry keys and values to collect host and configuration information and to obtain unsecured credentials stored in the Registry. High-confidence examples in the content include use of reg query against Registry paths such as HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default, HKEY_CURRENT_USER\Software<username>\PuTTY\Sessions, and HKLM\SOFTWARE for discovery of RDP, PuTTY, installed software, and related system information. The only directly named threat association for Reg in the content is Daggerfly.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Daggerfly

Daggerfly has used Reg to dump various Windows registry hives from victim machines.

via mitre attackattack.mitre.org

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1588.002ToolEvidence1

Multiple groups “obtained and used” publicly available/open-source tools (e.g., APT28 used Koadic/Mimikatz/Responder; APT29 used Mimikatz/SDelete/Tor/meek/Cobalt Strike; many others acquired tools such as PsExec, Impacket, Metasploit, etc.).

Persistence

1 technique

T1112Modify RegistryEvidence10

ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.

Stealth

1 technique

T1218System Binary Proxy ExecutionEvidence1

Gamaredon Group has used various legitimate tools, such as mshta.exe and Reg, and services during operations.

Defense Impairment

1 technique

T1112Modify RegistryEvidence10

Credential Access

2 techniques

T1003OS Credential DumpingEvidence1

The content includes hive extraction activity such as "Daggerfly used Reg to dump the Security Account Manager (SAM), System, and Security Windows registry hives from victim machines" and "Indrik Spider has used a service account to extract copies of the Security Registry hive."

T1552.002Credentials in RegistryEvidence2

Adversaries may search the Registry on compromised systems for insecurely stored credentials... Example commands to find Registry keys related to password information: Local Machine Hive: reg query HKLM /f password /t REG_SZ /s Current User Hive: reg query HKCU /f password /t REG_SZ /s

Discovery

2 techniques

T1012Query RegistryEvidence5

The content repeatedly describes malware and threat actors querying, enumerating, opening, and reading Windows Registry keys and values, e.g., "APT41 queried registry values to determine items such as configured RDP ports and network configurations" and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."

T1018Remote System DiscoveryEvidence1

"Reg may be used to interact with and modify the Windows Registry of a local or remote system at the command-line interface." / "Regin appears to have functionality to modify remote Registry information."

ACTIVITY FEED

Recent activity

7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

7 SOURCESView more in app

mitre attack websiteNews

May 1, 2022

Unsecured Credentials: Credentials in Registry, Sub-technique T1552.002 - Enterprise | MITRE ATT&CK®

Windows command-line utility that can be used to query the Registry and locate stored credentials.

mitre attack websiteNews

Mar 7, 2018

Query Registry, Technique T1012 - Enterprise | MITRE ATT&CK®

Command-line utility used to gather details from local or remote Windows Registry hives.

mitre attack websiteNews

Mar 7, 2018

Query Registry, Technique T1012 - Enterprise | MITRE ATT&CK®

Windows command-line utility used to query and gather Registry information locally or remotely.

mitre attackNews

Jan 24, 2026

Query Registry, Technique T1012 - Enterprise | MITRE ATT&CK®

Windows command-line utility used to query/export registry data locally or remotely (often abused by attackers).

+3 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Reg