Environment Description
| IP | HOSTNAME | NOTE |
|---|
| N/A | WIN10 | Test machine |
Overview
- During an attack, attackers often operate on the target machine's registry. One common method is to operate on the registry through
cmd.exe, while cmd.exe operates on the registry through the reg command.
Add and delete registry keys through the reg command
cmd.exe /c "reg add HKCU\SOFTWARE\Classes\CLSID\demo";
cmd.exe /c "REG DELETE HKCU\SOFTWARE\Classes\CLSID\demo" /f;
- The execution result is shown below:
- For details of other operations, refer to the following official Microsoft documentation link:
https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/reg