Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1012_query-registry
Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Passed 4 of 22 test cases with the skill, and 18 of 22 without it.
2 fixed16 passed either way1 still failing3 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
We want to enumerate Active Setup installed components using PowerShell cmdlets without spawning reg.exe. What cmdlet and path should be executed?
| Checked | Without skill | With skill |
|---|---|---|
| Uses Get-ChildItem cmdlet to enumerate subkey items. | Missed | Passed |
| Passes path HKLM:SOFTWARE\Microsoft\Active Setup\Installed Components. | Passed | Passed |
The instructions your model reads when the skill loads.
Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
The Registry contains a significant amount of information about the operating system, configuration, software, and security. Information can easily be queried using the Reg utility, though other means to access the Registry exist. Some of the information may help adversaries to further their operation within a network. Adversaries may use the information from Query Registry during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Platforms: Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Query Windows Registry. Upon successful execution, cmd.exe will perform multiple reg queries. Some will succeed and others will fail (dependent upon OS). References: https://blog.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order https://blog.cylance.com/windows-registry-persistence-part-1-introduction-attack-phases-and-windows-services http://www.handgrep.se/repository/cheatsheets/postexploitation/WindowsPost-Exploitation.pdf https://www.offensive-security.com/wp-content/uploads/2015/04/wp.Registry_Quick_Find_Chart.en_us.pdf
Supported Platforms: windows Elevation Required: Yes
test cases passed, vs 18 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.