TACTIC: DEFENSE EVASION
Modify Registry (T1112): Real Cases
MITRE Definition ↗ Adversaries modify the Windows registry to hide artifacts and disable security controls.
Key Facts
Technique ID
T1112
Defense Evasion
Mapped Cases
1
Primary sources
Related Laws
3
Criminal statutes
- ATT&CK Technique Identifier: T1112.
- Tactical Phase: Defense Evasion.
- Substantiated in 1 primary court prosecution and advisory cases.
- Linked records cite judicial dockets, plea agreements, or federal advisories.
Verified Evidentiary Case Records (1)
U.S. v. Vachon-Desjardins (Netwalker Ransomware)
sentenced 2020-12-16
Affiliate of Netwalker ransomware responsible for attacking dozens of healthcare systems, universities, and businesses during the COVID-19 pandemic, extorting tens of millions of dollars.
Primary Source Evidence Excerpt: Plea Agreement ¶ 6, Page 14
"Netwalker modified registry keys under HKLM\SYSTEM\CurrentControlSet\Control\Lsa to weaken local security authority validation."
U.S. District Court for the Middle District of Florida · 8:20-cr-00366
View full case dossier →
Commonly Charged Criminal Statutes
18 U.S.C. § 1030(a)(5)(A)
Intentional Damage to a Protected Computer
Prohibits knowingly causing the transmission of a program, information, code, or command that intentionally causes damage without authorization to a protected computer.
18 U.S.C. § 1030(a)(7)
Extortion in Connection with Computers
Prohibits transmitting in interstate or foreign commerce threats to cause damage to a protected computer or obtain confidential information with intent to extort money or value.
18 U.S.C. § 1956
Money Laundering
Prohibits conducting financial transactions knowing that the property involved represents the proceeds of unlawful activity to promote unlawful activity or conceal the nature or ownership of the proceeds.