The Registry
Keys and persistence.
The Registry is a free Ethical Hacking Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Ethical Hacking Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What Is the Registry
The Windows Registry is a hierarchical database storing configuration for the OS, drivers, services, and applications.
For attackers it is a goldmine: persistence locations, stored credentials, and system settings all live here.
Hives and Root Keys
The registry is organized into root keys (hives):
- HKLM - HKEY_LOCAL_MACHINE, system-wide settings.
- HKCU - HKEY_CURRENT_USER, per-user settings.
- HKCR, HKU, HKCC - classes, all users, current config.
Keys and Values
A key is like a folder; it contains values (name, type, data). Common value types include REG_SZ (string), REG_DWORD (number), and REG_BINARY.
Reading the Registry
Use reg query at the command line or PowerShell to read keys and values.
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion"
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion"Writing the Registry
Adding or changing values lets you alter system behavior - and is how malware persists. This requires appropriate privileges.
reg add "HKCU\Software\Demo" /v Flag /t REG_SZ /d enabled /fRun Keys - Persistence
The classic persistence mechanism: programs listed in Run keys launch automatically at logon.
HKCU\...\CurrentVersion\RunHKLM\...\CurrentVersion\Run
Defenders audit these; attackers plant entries here.
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"Other Persistence Locations
Beyond Run keys, attackers abuse:
- RunOnce keys.
- Winlogon Shell/Userinit values.
- Services keys under
HKLM\SYSTEM\CurrentControlSet\Services. - Image File Execution Options (debugger hijack).
Credentials in the Registry
Sensitive data sometimes lands in the registry:
- AutoLogon credentials in plaintext under Winlogon.
- SAM hashes under
HKLM\SAM(protected). - VNC, SNMP, and app passwords.
Enumerating these is a standard post-exploitation step.
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPasswordRegistry Hives on Disk
Hives are backed by files under C:\Windows\System32\config (SYSTEM, SOFTWARE, SAM, SECURITY). Per-user data lives in NTUSER.DAT.
Offline attacks copy these files to extract secrets without the live OS protecting them.
Auditing with Autoruns
The Sysinternals Autoruns tool enumerates every auto-start location across the registry and file system in one view.
It is the fastest way to spot persistence entries planted by malware or an attacker.
Defensive View
Defenders monitor registry changes to detect intrusion:
- Sysmon logs registry modifications.
- Baseline Run/RunOnce and Services keys.
- Alert on new auto-start entries.
Quick Check
Identify the persistence mechanism.
Recap
You explored the Windows Registry:
- Hives (HKLM, HKCU...) hold keys and values.
- Read/write with
reg query/reg add. - Run keys, Winlogon, and Services enable persistence.
- Credentials can hide in the registry; Autoruns and Sysmon audit it.
Next: Windows authentication.
Frequently asked questions
Is the “The Registry” lesson free?
Yes — the full text of “The Registry” is free to read here on the web, and the Ethical Hacking Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Ethical Hacking Academy course, upgrade to CoddyKit PRO.
What will I learn in “The Registry”?
Keys and persistence. You practise Ethical Hacking Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Ethical Hacking Academy?
No prior experience is required. Ethical Hacking Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “The Registry” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Ethical Hacking Academy lesson?
Yes. Every Ethical Hacking Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.