sigmalowHunting

System Information Discovery via Registry Queries

Detects attempts to query system information directly from the Windows Registry.

MITRE ATT&CK

discovery

Detection Query

selection_cmd_reg:
  Image|endswith: \reg.exe
  CommandLine|contains: query
  CommandLine|contains|windash: -v
selection_cmd_powershell:
  Image|endswith:
    - \powershell.exe
    - \pwsh.exe
  CommandLine|contains:
    - Get-ItemPropertyValue
    - gpv
selection_keys:
  CommandLine|contains:
    - \SOFTWARE\Microsoft\Windows Defender
    - \SOFTWARE\Microsoft\Windows NT\CurrentVersion
    - \SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
    - \SYSTEM\CurrentControlSet\Control\TimeZoneInformation
    - \SYSTEM\CurrentControlSet\Services
condition: 1 of selection_cmd_* and selection_keys

Author

lazarg

Created

2025-06-12

Data Sources

windowsProcess Creation Events

Platforms

windows

References

Tags

attack.discoveryattack.t1082

Raw Content

title: System Information Discovery via Registry Queries
id: 0022869c-49f7-4ff2-ba03-85ac42ddac58
status: experimental
description: Detects attempts to query system information directly from the Windows Registry.
references:
    - https://cert.gov.ua/article/6277849
    - https://github.com/redcanaryco/atomic-red-team/blob/75fa21076dcefa348a7521403cdd6bfc4e88623c/atomics/T1082/T1082.md
    - https://github.com/redcanaryco/atomic-red-team/blob/75fa21076dcefa348a7521403cdd6bfc4e88623c/atomics/T1124/T1124.md
author: lazarg
date: 2025-06-12
modified: 2025-10-25
tags:
    - attack.discovery
    - attack.t1082
logsource:
    category: process_creation
    product: windows
detection:
    selection_cmd_reg:
        Image|endswith: '\reg.exe'
        CommandLine|contains: 'query'
        CommandLine|contains|windash: '-v'
    selection_cmd_powershell:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains:
            - 'Get-ItemPropertyValue'
            - 'gpv'
    selection_keys:
        CommandLine|contains:
            - '\SOFTWARE\Microsoft\Windows Defender' # Details about defender state
            - '\SOFTWARE\Microsoft\Windows NT\CurrentVersion' # Provides details about the OS
            - '\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall' # Lists installed programs
            - '\SYSTEM\CurrentControlSet\Control\TimeZoneInformation' # Contains time zone details
            - '\SYSTEM\CurrentControlSet\Services' # Details about existing services
    condition: 1 of selection_cmd_* and selection_keys
falsepositives:
    - Unlikely
level: low
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_discovery_via_reg_queries/info.yml
simulation:
    - type: atomic-red-team
      name: System Information Discovery
      technique: T1010
      atomic_guid: 66703791-c902-4560-8770-42b8a91f7667
    - type: atomic-red-team
      name: Discover OS Product Name via Registry
      technique: T1082
      atomic_guid: be3b5fe3-a575-4fb8-83f6-ad4a68dd5ce7
    - type: atomic-red-team
      name: Discover OS Build Number via Registry
      technique: T1082
      atomic_guid: acfcd709-0013-4f1e-b9ee-bc1e7bafaaec