Services Registry Permissions Weakness
Subtechnique · ATTACK:enterprise:T1574.011
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1574.011",
"title": "Services Registry Permissions Weakness",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1574/011",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--17cc750b-e95b-4d7d-9dde-49e0de24148c",
"external_id": "T1574.011",
"domain": "enterprise",
"created": "2020-03-13T11:42:14.444Z",
"modified": "2026-05-12T15:12:00.622Z",
"version": "2.0",
"aliases": [
],
"tactics": [
"stealth",
"execution"
],
"source_references": [
{
"source_name": "Tweet Registry Perms Weakness",
"url": "https://x.com/r0wdy_/status/936365549553991680"
},
{
"source_name": "insecure_reg_perms",
"url": "https://itm4n.github.io/windows-registry-rpceptmapper-eop/"
},
{
"source_name": "hexacorn",
"url": "https://www.hexacorn.com/blog/2015/01/13/beyond-good-ol-run-key-part-24/"
},
{
"source_name": "Kansa Service related collectors",
"url": "https://trustedsignal.blogspot.com/2014/05/kansa-service-related-collectors-and.html"
},
{
"source_name": "malware_hides_service",
"url": "https://www.bleepingcomputer.com/tutorials/how-malware-hides-as-a-service/"
},
{
"source_name": "MDSec",
"url": "https://www.mdsec.co.uk/2022/10/autodialdlling-your-way/"
},
{
"source_name": "Registry Key Security",
"url": "https://docs.microsoft.com/en-us/windows/win32/sysinfo/registry-key-security-and-access-rights?redirectedfrom=MSDN"
},
{
"source_name": "microsoft_services_registry_tree",
"url": "https://docs.microsoft.com/en-us/windows-hardware/drivers/install/hklm-system-currentcontrolset-services-registry-tree"
},
{
"source_name": "gendigital",
"url": "https://www.gendigital.com/blog/insights/research/operation-dragon-castling-apt-group-targeting-betting-companies"
}
]
}Explicit source assertions (3)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:M1024 → mitigates → ATTACK:enterprise:T1574.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--469231fb-3797-49bf-9f23-078b37a35671
ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1574.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--981648bc-e5b1-46b3-adf6-92caae84cfa4
McAfee HoneybeeATTACK:enterprise:T1574.011 → subtechnique-of → ATTACK:enterprise:T1574
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--def869f4-7564-4a09-8f49-59cb696b660d