.. / reg.exe

Query and edit the registry

Registry

Query registry key

reg.exe query "\\W10.ad.bitsadmin.com\HKLM\Software\Microsoft\Windows\CurrentVersion\Run"

• T1012
• T1547.001

Set registry value

reg.exe add \\W10.ad.bitsadmin.com\HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin /d 0 /t REG_DWORD

• Configure the remote system, e.g. to support Kerberos authentication for remote desktop
• Configure the automatic start of an implant upon boot