CAPEC-270
Modification of Registry Run Keys
An adversary adds a new entry to the "run keys" in the Windows registry so that an application of their choosing is executed when a user logs in. In this way, the adversary can get their executable to operate and run on the target system with the authorized user's level of permissions. This attack is a good way for an adversary to run persistent spyware on a user's machine, such as a keylogger.
On this page
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-270: Modification of Registry Run Keys: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/270.html and https://cve.bz/cve/capec/270?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
How the attack unfolds
Explore
The attacker looks for a way in.
[Determine target system] The adversary must first determine the system they wish to target. This attack only works on Windows.
Experiment
They probe what they found.
[Gain access to the system] The adversary needs to gain access to the system in some way so that they can modify the Windows registry.
2 techniques
- Gain physical access to a system either through shoulder surfing a password or accessing a system that is left unlocked.
- Gain remote access to a system through a variety of means.
Exploit
They carry out the attack.
[Modify Windows registry] The adversary will modify the Windows registry by adding a new entry to the "run keys" referencing a desired program. This program will be run whenever the user logs in.
Prerequisites
The adversary must have gained access to the target system via physical or logical means in order to carry out this attack.
Consequences
| Impact | Affects | Note |
|---|---|---|
| Modify Data, Gain Privileges | Integrity |
Mitigations
Identify programs that may be used to acquire process information and block them by using a software restriction policy or tools that restrict program execution by using a process allowlist.
Weaknesses it exploits
- CWE-15 External Control of System or Configuration Setting
Recent CVEs with these weaknesses
- 8.8CVE-2026-13292
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code by inject…
- 7.1CVE-2026-121614
Docker Sandboxes versions 0.31.0 before 0.50.0 do not neutralize repository-controlled Git configuration when running certain host-side Git commands. An attacker who can modify a host repository's Git configuration, for example through a d…
- 8.7CVE-2026-121427
AzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT /station/{id}/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Shou…
- 4.6CVE-2025-68403
An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system. We have a…
- 7.7CVE-2026-110845
n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code execution vulnerability in the Git node Log operation, which fails to strip a repository's local git configuration before invoking an external program. Authen…
- 5.5CVE-2026-96218
Improper access control in Windows Update Stack allows an authorized attacker to perform tampering locally.
- 7.3CVE-2026-96188
External control of system or configuration setting in Microsoft PowerToys allows an authorized attacker to elevate privileges locally.
- 7.8CVE-2026-73027
External control of system or configuration setting in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
- Part of
- CAPEC-203 Manipulate Registry Information
- Can lead to
- Can follow
- CAPEC-555 Remote Services with Stolen Credentials
Examples
An adversary can place a malicious executable (RAT) on the target system and then configure it to automatical…
An adversary can place a malicious executable (RAT) on the target system and then configure it to automatically run when the user logs in to maintain persistence on the target system.
Through the modification of registry "run keys" the adversary can masquerade a malicious executable as a legi…
Through the modification of registry "run keys" the adversary can masquerade a malicious executable as a legitimate program.
MITRE's words, unchanged: CAPEC-270 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.