{"id":18401127,"url":"https://github.com/d3fenderz/windows_reg","last_synced_at":"2025-04-12T17:00:15.895Z","repository":{"id":135407061,"uuid":"597539738","full_name":"d3fenderz/windows_reg","owner":"d3fenderz","description":"Cheat sheet reg Windows","archived":false,"fork":false,"pushed_at":"2023-04-13T13:32:20.000Z","size":44,"stargazers_count":5,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-02-16T03:25:57.092Z","etag":null,"topics":["blueteam","cheatsheet","guide","reg","registry","security-guide","windows"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/d3fenderz.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-02-04T21:17:29.000Z","updated_at":"2025-01-11T20:06:01.000Z","dependencies_parsed_at":"2023-05-05T11:20:53.945Z","dependency_job_id":null,"html_url":"https://github.com/d3fenderz/windows_reg","commit_stats":null,"previous_names":["d3fenderz/windows_reg"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/d3fenderz%2Fwindows_reg","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/d3fenderz%2Fwindows_reg/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/d3fenderz%2Fwindows_reg/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/d3fenderz%2Fwindows_reg/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/d3fenderz","download_url":"https://codeload.github.com/d3fenderz/windows_reg/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248602273,"owners_count":21131613,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["blueteam","cheatsheet","guide","reg","registry","security-guide","windows"],"created_at":"2024-11-06T02:37:48.146Z","updated_at":"2025-04-12T17:00:15.844Z","avatar_url":"https://github.com/d3fenderz.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"#  Windows Reg\n\nCheat sheet reg queries Windows\n\nTO BE CONTINUED indefinitely...\n\n![GitHub last commit](https://img.shields.io/github/last-commit/d3fenderz/windows_reg?label=last%20update%3A)\n\n## Read information\n\n### Get user env var\n\n```\nreg query HKCU\\Environment /v {Variable Name}\n```\n\n### Get AppData path\n\n```\nreg query HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders /v AppData\n```\n\n### Get user document's folder\n\n```\nreg query HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\n```\n\n### Get last registred key\n\n```\nreg query HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Applets\\RegEdit /v LastKey\n```\n\n### Get typed URL\n\n```\nreg query HKCU\\Software\\Microsoft\\InternetExplorer\\TypedURLS\n```\n\n### Regex to find \"password\" in the Registry\n\n```\nreg query HKLM /f password /t REG_SZ /s \nreg query HKCU /f password /t REG_SZ /s\n```\n\n### Inspect autologon\n\n```\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\Currentversion\\Winlogon\" 2\u003enul | findstr \"DefaultUserName DefaultDomainName DefaultPassword\"\n```\n\n### Inspect startup (any sign of persistence)\n\n```\nreg query HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\nreg query HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\nreg query HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\nreg query HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\n```\n\n### Get system policies\n\n```\nreg query HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\n```\n\n### Get security policy\n\n```\nreg query HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa /v forceguest\n```\n\n### Get automatic updates status\n\n```\nreg query HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update /v AUOptions\n```\n\n### Get Admin token\n\n```\nreg query HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v FilterAdministratorToken\n```\n\n### Get Windows Defender settings \n\n=\u003e Group Policy switch:\n\n```\nreg query HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender /v DisableAntiSpyware\n```\n\n### Get service config\n\n```\nreg query HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services /s\n```\n\n### Get Firewall config\n\n```\nreg query HKLM\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\n```\n\n### Get UAC (User Account Control) config\n\n```\nreg query HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v ConsentPromptBehaviorAdmin\n```\n\n### Get autorun config\n\n```\nreg query HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer /v NoDriveTypeAutoRun\n```\n\n### Inspect SNMP config\n\n```\nreg query HKLM\\SYSTEM\\CurrentControlSet\\Services\\SNMP /s\n```\n\n### Wrapper to search terms\n\n=\u003e Get all keys that match \"XXX\":\n\n```\nreg query HKLM\\SOFTWARE\\Microsoft /s /f XXX /k\n```\n\n## Tweak settings\n\n### ⚠️ Take cover\n\n🚨 **Always backup** the Registry **before** tweaking entries! 🚨\n\n### Windows Defender\n\n#### Disable Windows Defender\n\n```\nreg add \"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\" /v DisableAntiSpyware /t REG_DWORD /d 1 /f\n```\n\n#### Enable Windows Defender\n\n```\nreg delete \"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\" /v DisableAntiSpyware\n```\n\n### UAC\n\n#### Disable UAC\n\n```\nreg add \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" /v EnableLUA /t REG_DWORD /d 0 /f\n```\n\n#### Enable UAC\n\n```\nreg add \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" /v EnableLUA /t REG_DWORD /d 1 /f\n```\n\n### Gain persistence with reg\n\n```\nreg add \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v BadGuy /t REG_SZ /d \"C:\\Users\\Victim\\evil.exe\"\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\"\n```\n\n## Useful links\n\n* [Windows Commands: reg](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/reg)\n* [Windows Userland Persistence Fundamentals](https://fuzzysecurity.com/tutorials/19.html)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fd3fenderz%2Fwindows_reg","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fd3fenderz%2Fwindows_reg","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fd3fenderz%2Fwindows_reg/lists"}