T1012 — Query Registry

Tactic: Discovery · Platforms: Windows

Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software. The Registry contains a significant amount of information about the operating system, configuration, software, and security. Information can easily be queried using the…

Sigma detection rules (1)

T1012 Query Registry

title: T1012 Query Registry
id: e60f5b17-9e10-4180-a5c6-08eac1b68079
description: 'Detection of Registry Query for Environmental Discovery. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: TargetRegistryPath, ParentProcess, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1012
author: Shahrukh Khan
date: 2026-06-17
license: MIT
tags:
  - attack.discovery
  - attack.t1012

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_reg:
    Image|endswith: '\reg.exe'
    CommandLine|contains: 'query'

  selection_ps:
    CommandLine|contains: 'Get-ItemProperty'

  condition: 1 of selection_*

falsepositives:
  - Extremely common in legitimate administration, software installers, and configuration-management tooling.

level: informational

Explore