{"id":"T1012","name":"Query Registry","url":"https://attack.mitre.org/techniques/T1012","tactics":["discovery"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0209","stix_id":"x-mitre-detection-strategy--106e32a9-29b7-4ec7-80cf-768662706490","name":"Detection of Registry Query for Environmental Discovery","url":"https://attack.mitre.org/detectionstrategies/DET0209","analytics":[{"id":"AN0589","stix_id":"x-mitre-analytic--8986f2ab-2e6d-4c68-99ac-6a1c5f29fb7b","name":"Analytic 0589","description":"Registry read access associated with suspicious or non-interactive processes querying system config, installed software, or security settings.","url":"https://attack.mitre.org/detectionstrategies/DET0209#AN0589","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"wineventlog-powershell"}],"mutable_elements":[{"field":"TargetRegistryPath","description":"Focus detection on registry hives or keys likely to reveal environment info (e.g., HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion)."},{"field":"ParentProcess","description":"May tune for suspicious parent processes such as cmd.exe, wscript.exe, or mshta.exe."},{"field":"TimeWindow","description":"Controls how closely registry access must follow process creation for correlation."}],"live":true,"detection_strategies":["DET0209"],"techniques":["T1012"]}],"live":true,"version":"1.0","techniques":["T1012"]}],"sigma_rules":[{"id":"064060aa-09fb-4636-817f-020a32aa7e9e","title":"Potential Registry Reconnaissance Via PowerShell Script","author":"frack113","status":"test","level":"medium","date":"2023-07-02","modified":null,"description":"Detects PowerShell scripts with potential registry reconnaissance capabilities. Adversaries may interact with the Windows registry to gather information about the system credentials, configuration, and installed software.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1012/T1012.md"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.discovery","attack.t1012","attack.t1007","detection.threat-hunting"],"path":"rules-threat-hunting/windows/powershell/powershell_script/posh_ps_registry_reconnaissance.yml","techniques":["T1012","T1007"],"cves":[]},{"id":"1cfac73c-be78-4f9a-9b08-5bde0c3953ab","title":"Operation Wocao Activity","author":"Florian Roth (Nextron Systems), frack113","status":"test","level":"high","date":"2019-12-20","modified":"2022-10-09","description":"Detects activity mentioned in Operation Wocao report","references":["https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/","https://twitter.com/SBousseaden/status/1207671369963646976"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.persistence","attack.discovery","attack.stealth","attack.t1012","attack.t1036.004","attack.t1027","attack.execution","attack.t1053.005","attack.t1059.001","detection.emerging-threats"],"path":"rules-emerging-threats/2019/TA/Operation-Wocao/proc_creation_win_apt_wocao.yml","techniques":["T1012","T1036.004","T1027","T1053.005","T1059.001"],"cves":[]},{"id":"1d2ab8ac-1a01-423b-9c39-001510eae8e8","title":"Azure AD Health Service Agents Registry Keys Access","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC","status":"test","level":"medium","date":"2021-08-26","modified":"2022-10-09","description":"This detection uses Windows security events to detect suspicious access attempts to the registry key values and sub-keys of Azure AD Health service agents (e.g AD FS).\nInformation from AD Health service agents can be used to potentially abuse some of the features provided by those services in the cloud (e.g. Federation).\nThis detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object: HKLM:\\SOFTWARE\\Microsoft\\ADHealthAgent.\nMake sure you set the SACL to propagate to its sub-keys.\n","references":["https://o365blog.com/post/hybridhealthagent/","https://github.com/OTRF/Set-AuditRule/blob/c3dec5443414231714d850565d364ca73475ade5/rules/registry/aad_connect_health_service_agent.yml"],"logsource":{"product":"windows","service":"security"},"tags":["attack.discovery","attack.t1012"],"path":"rules/windows/builtin/security/win_security_aadhealth_svc_agent_regkey_access.yml","techniques":["T1012"],"cves":[]},{"id":"2b30fa36-3a18-402f-a22d-bf4ce2189f35","title":"Potential Baby Shark Malware Activity","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2019-02-24","modified":"2023-03-08","description":"Detects activity that could be related to Baby Shark malware","references":["https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.discovery","attack.stealth","attack.t1012","attack.t1059.003","attack.t1059.001","attack.t1218.005","detection.emerging-threats"],"path":"rules-emerging-threats/2019/Malware/BabyShark/proc_creation_win_malware_babyshark.yml","techniques":["T1012","T1059.003","T1059.001","T1218.005"],"cves":[]},{"id":"68fcba0d-73a5-475e-a915-e8b4c576827e","title":"Remote Registry Management Using Reg Utility","author":"Teymur Kheirkhabarov, oscd.community","status":"test","level":"medium","date":"2019-10-22","modified":"2023-12-15","description":"Remote registry management using REG utility from non-admin workstation","references":["https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment"],"logsource":{"product":"windows","service":"security"},"tags":["attack.credential-access","attack.persistence","attack.discovery","attack.defense-impairment","attack.s0075","attack.t1012","attack.t1112","attack.t1552.002"],"path":"rules-placeholder/windows/builtin/security/win_security_remote_registry_management_via_reg.yml","techniques":["T1012","T1112","T1552.002"],"cves":[]},{"id":"74ad4314-482e-4c3e-b237-3f7ed3b9ca8d","title":"Operation Wocao Activity - Security","author":"Florian Roth (Nextron Systems), frack113","status":"test","level":"high","date":"2019-12-20","modified":"2022-11-27","description":"Detects activity mentioned in Operation Wocao report","references":["https://web.archive.org/web/20200226212615/https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/","https://web.archive.org/web/20200226212615/https://resources.fox-it.com/rs/170-CAK-271/images/201912_Report_Operation_Wocao.pdf","https://twitter.com/SBousseaden/status/1207671369963646976"],"logsource":{"product":"windows","service":"security"},"tags":["attack.privilege-escalation","attack.persistence","attack.discovery","attack.stealth","attack.t1012","attack.t1036.004","attack.t1027","attack.execution","attack.t1053.005","attack.t1059.001","detection.emerging-threats"],"path":"rules-emerging-threats/2019/TA/Operation-Wocao/win_security_apt_wocao.yml","techniques":["T1012","T1036.004","T1027","T1053.005","T1059.001"],"cves":[]},{"id":"82880171-b475-4201-b811-e9c826cd5eaa","title":"Exports Critical Registry Keys To a File","author":"Oddvar Moe, Sander Wiebing, oscd.community","status":"test","level":"high","date":"2020-10-12","modified":"2024-03-13","description":"Detects the export of a crital Registry key to a file.","references":["https://lolbas-project.github.io/lolbas/Binaries/Regedit/","https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.exfiltration","attack.discovery","attack.t1012"],"path":"rules/windows/process_creation/proc_creation_win_regedit_export_critical_keys.yml","techniques":["T1012"],"cves":[]},{"id":"970007b7-ce32-49d0-a4a4-fbef016950bd","title":"Potential Configuration And Service Reconnaissance Via Reg.EXE","author":"Timur Zinniatullin, oscd.community","status":"test","level":"medium","date":"2019-10-21","modified":"2023-02-05","description":"Detects the usage of \"reg.exe\" in order to query reconnaissance information from the registry. Adversaries may interact with the Windows registry to gather information about credentials, the system, configuration, and installed software.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1012/T1012.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1012","attack.t1007"],"path":"rules/windows/process_creation/proc_creation_win_reg_query_registry.yml","techniques":["T1012","T1007"],"cves":[]},{"id":"9a4ff3b8-6187-4fd2-8e8b-e0eae1129495","title":"SysKey Registry Keys Access","author":"Roberto Rodriguez @Cyb3rWard0g","status":"test","level":"high","date":"2019-08-12","modified":"2021-11-27","description":"Detects handle requests and access operations to specific registry keys to calculate the SysKey","references":["https://threathunterplaybook.com/hunts/windows/190625-RegKeyAccessSyskey/notebook.html"],"logsource":{"product":"windows","service":"security"},"tags":["attack.discovery","attack.t1012"],"path":"rules/windows/builtin/security/win_security_syskey_registry_access.yml","techniques":["T1012"],"cves":[]},{"id":"a0e417e2-2fa1-40da-b6d2-e094cd5e1191","title":"Registry Enumeration via WMI Stdregprov","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-07-30","modified":"2026-06-19","description":"Detects the usage of wmic.exe to enumerate or read Windows registry via the WMI StdRegProv class read methods (EnumKey, EnumValues, GetStringValue, etc.).\nWhile registry reads are common, attackers may use this technique to perform reconnaissance and discover sensitive configuration values, credentials, or installed software.\nThe use of WMI as an alternative to standard tools like reg.exe can indicate an attempt to evade detection focused on traditional registry query commands.\n","references":["https://trustedsec.com/blog/command-line-underdog-wmic-in-action","https://trustedsec.com/blog/wmi-for-script-kiddies","https://learn.microsoft.com/en-us/previous-versions/windows/desktop/regprov/stdregprov"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1047","attack.discovery","attack.t1012"],"path":"rules/windows/process_creation/proc_creation_win_wmic_stdregprov_reg_enumeration.yml","techniques":["T1047","T1012"],"cves":[]},{"id":"f0e53e89-8d22-46ea-9db5-9d4796ee2f8a","title":"Exports Registry Key To a File","author":"Oddvar Moe, Sander Wiebing, oscd.community","status":"test","level":"low","date":"2020-10-07","modified":"2024-03-13","description":"Detects the export of the target Registry key to a file.","references":["https://lolbas-project.github.io/lolbas/Binaries/Regedit/","https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.exfiltration","attack.discovery","attack.t1012"],"path":"rules/windows/process_creation/proc_creation_win_regedit_export_keys.yml","techniques":["T1012"],"cves":[]},{"id":"f8748f2c-89dc-4d95-afb0-5a2dfdbad332","title":"SAM Registry Hive Handle Request","author":"Roberto Rodriguez @Cyb3rWard0g","status":"test","level":"high","date":"2019-08-12","modified":"2021-11-27","description":"Detects handles requested to SAM registry hive","references":["https://threathunterplaybook.com/hunts/windows/190725-SAMRegistryHiveHandleRequest/notebook.html"],"logsource":{"product":"windows","service":"security"},"tags":["attack.discovery","attack.t1012","attack.credential-access","attack.t1552.002"],"path":"rules/windows/builtin/security/win_security_sam_registry_hive_handle_request.yml","techniques":["T1012","T1552.002"],"cves":[]},{"id":"fca949cc-79ca-446e-8064-01aa7e52ece5","title":"HackTool - PCHunter Execution","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali","status":"test","level":"high","date":"2022-10-10","modified":"2024-11-23","description":"Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff","references":["https://web.archive.org/web/20231210115125/http://www.xuetr.com/","https://www.crowdstrike.com/blog/falcon-overwatch-report-finds-increase-in-ecrime/","https://www.hexacorn.com/blog/2018/04/20/kernel-hacking-tool-you-might-have-never-heard-of-xuetr-pchunter/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.discovery","attack.t1082","attack.t1057","attack.t1012","attack.t1083","attack.t1007"],"path":"rules/windows/process_creation/proc_creation_win_hktl_pchunter.yml","techniques":["T1082","T1057","T1012","T1083","T1007"],"cves":[]},{"id":"ff151c33-45fa-475d-af4f-c2f93571f4fe","title":"Azure AD Health Monitoring Agent Registry Keys Access","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC","status":"test","level":"medium","date":"2021-08-26","modified":"2022-10-09","description":"This detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health monitoring agent.\nThis detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object HKLM\\SOFTWARE\\Microsoft\\Microsoft Online\\Reporting\\MonitoringAgent.\n","references":["https://o365blog.com/post/hybridhealthagent/","https://github.com/OTRF/Set-AuditRule/blob/c3dec5443414231714d850565d364ca73475ade5/rules/registry/aad_connect_health_monitoring_agent.yml"],"logsource":{"product":"windows","service":"security"},"tags":["attack.discovery","attack.t1012"],"path":"rules/windows/builtin/security/win_security_aadhealth_mon_agent_regkey_access.yml","techniques":["T1012"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}