reg.exe

reg.exe reads and modifies the Windows registry from the command line. Its main verbs are reg query, reg add, reg delete, reg export and reg import for text .reg files, and reg save and reg load for binary hive files. Several operations can act on a remote machine by prefixing a host, as in reg query \\host\HKLM\.... The genuine binary lives at C:\Windows\System32\reg.exe.

Legitimately, reg is run constantly by installers, scripts, and administrators to read and set configuration, so the process is unremarkable. The key it touches and whether it is reading or writing, both on the command line, are what give an instance meaning.

reg.exe is a common persistence tool (T1547.001). Writing to a Run key, under HKCU or HKLM ...\CurrentVersion\Run, or to another autostart point makes a program launch at logon or boot. Anything added to Run, to the Winlogon Shell or Userinit values, or similar startup locations that points to a script host or a user-writable binary is suspect.

It is also a route to local credentials (T1003.002). reg save HKLM\SAM and reg save HKLM\SYSTEM export the hive files that hold local account password hashes and the boot key needed to decrypt them, and HKLM\SECURITY holds LSA secrets. Saving any of these and moving the files off the host is a recognizable credential-theft step. reg also harvests secrets that applications leave in the registry, such as autologon passwords (T1552.002).

Beyond that, reg supports both reconnaissance and defense evasion. reg query enumerates installed software, configuration, and stored credentials (T1012), while reg add and reg delete flip security-relevant settings off, disabling Defender features or UAC, for example (T1112). Because reg is a normal administrative tool, the key path, the direction, the parent, and any remote target are what separate configuration from abuse.