H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Tool

Reg

[Reg](https://attack.mitre.org/software/S0075) is a Windows utility used to interact with the Windows Registry. It can be used at the command-line interface to query, add, modify, and remove information. (Citation: Microsoft Reg) Utilities such as [Reg](https://attack.mitre.org/software/S0075) are known to be used by persistent threats. (Citation: Windows Commands JPCERT)

Tool
TypeTool
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Reg](https://attack.mitre.org/software/S0075) is a Windows utility used to interact with the Windows Registry. It can be used at the command-line interface to query, add, modify, and remove information. (Citation: Microsoft Reg) Utilities such as [Reg](https://attack.mitre.org/software/S0075) are known to be used by persistent threats. (Citation: Windows Commands JPCERT)

Labels

tool
12 recorded

Relationships

uses
from Daggerfly
Group
uses
from Dragonfly
Group
uses
from GALLIUM
Group
uses
from Gamaredon Group
Group
uses
from OilRig
Group
uses
from Operation Honeybee
Campaign
uses
from Rancor
Group
uses
to Credentials in Registry
Technique
uses
to Modify Registry
Technique
uses
to Query Registry
Technique
uses
from Turla
Group
uses
from Volt Typhoon
Group
3 external

References

mitre-attack
S0075
open
Microsoft Reg
https://technet.microsoft.com/en-us/library/cc732643.aspx
open
Windows Commands JPCERT
https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance