Modify Remote Registry

Use Windows reg.exe to modify a Registry value on an authorized remote Windows host. Remote Registry access requires the target Remote Registry service to be running; the account and key ACLs govern access, and ATT&CK describes remote access through SMB/Windows Admin Shares for RPC. This record scopes T1112 to a remote machine Run-key value, which Windows processes at user logon; a successful write alone does not establish that the referenced program later ran.