Skip to content

Restrict Registry Permissions

Mitigation · ATTACK:enterprise:M1024

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:M1024",
  "title": "Restrict Registry Permissions",
  "type": "Mitigation",
  "source_url": "https://attack.mitre.org/mitigations/M1024",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "course-of-action--a2c36a5d-4058-475e-8e77-fff75e50d3b9",
  "external_id": "M1024",
  "domain": "enterprise",
  "created": "2019-06-06T20:58:59.577Z",
  "modified": "2026-05-12T15:12:00.731Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [

  ]
}

Explicit source assertions (20)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:M1024 → mitigates → ATTACK:enterprise:T1547.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08f53e1a-7326-48ed-ac0e-2b0af2d93985

Microsoft W32Time May 2017

ATTACK:enterprise:M1024 → mitigates → ATTACK:enterprise:T1574.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c597fa3-aeb4-472c-9fba-6855e5d512b0

ATTACK:enterprise:M1024 → mitigates → ATTACK:enterprise:T1037.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f7dd352-4e6b-4852-a995-7b22c98b4fd2

ATTACK:enterprise:M1024 → mitigates → ATTACK:enterprise:T1556.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b63a6ee-50e9-4c72-8654-1d879f4eb88e

ATTACK:enterprise:M1024 → mitigates → ATTACK:enterprise:T1556

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1fea6d3f-b097-4e4e-b089-5abd6e2659e7

ATTACK:enterprise:M1024 → mitigates → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--283bdd31-247b-47aa-886b-66db5ca13eff

ATTACK:enterprise:M1024 → mitigates → ATTACK:enterprise:T1505

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--32c23405-9962-4f12-8774-fdf04328ac84

Microsoft System Services Fundamentals

ATTACK:enterprise:M1024 → mitigates → ATTACK:enterprise:T1505.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a3dd5f2-61af-4617-81b0-c12900f5f8e6

ATTACK:enterprise:M1024 → mitigates → ATTACK:enterprise:T1685.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4316c8f0-37e1-4a99-a34f-362ec94fe6b9

def_ev_win_event_logging

ATTACK:enterprise:M1024 → mitigates → ATTACK:enterprise:T1574.011

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--469231fb-3797-49bf-9f23-078b37a35671

ATTACK:enterprise:M1024 → mitigates → ATTACK:enterprise:T1070.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6127605c-df31-4810-a24c-77a965399c90

ATTACK:enterprise:M1024 → mitigates → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--81bb4898-aaa2-4dff-9af8-a97e6b69a95a

ATTACK:enterprise:M1024 → mitigates → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--85422378-e9d7-4bd2-8b57-73fba0641448

ATTACK:enterprise:M1024 → mitigates → ATTACK:enterprise:T1553.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--90ad45d7-1980-4909-97f2-3c5a10a47deb

ATTACK:enterprise:M1024 → mitigates → ATTACK:enterprise:T1037

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9e755287-a238-485c-83c3-7afeac5a9243

ATTACK:enterprise:M1024 → mitigates → ATTACK:enterprise:T1553

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a152969e-2530-4cb7-acdf-f93b138116d0

ATTACK:enterprise:M1024 → mitigates → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a2a81edb-693e-416d-b42d-671c950d88d7

ATTACK:enterprise:M1024 → mitigates → ATTACK:enterprise:T1686.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a58e681b-7b34-426b-ba4f-2983c9de6316

ATTACK:enterprise:M1024 → mitigates → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c00535d0-6e59-4293-8034-70e5bf94a74a

ATTACK:enterprise:M1024 → mitigates → ATTACK:enterprise:T1553.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f32c486c-37f6-48c2-bdff-f9468d7b9601

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.