T1012 · Query Registry

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1012 · Query Registry · Sunturai

attack-patternenterprise-attackT1012

Query Registry

attack-pattern--c32f7008-9fea-41f7-8366-5eb9b74bd896

Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software. The Registry contains a significant amount of information about the operating system, configuration, software, and security.(Citation: Wikipedia Windows Registry) Information can easily be queried using the Reg utility, though other means to access the Registry exist. Some of the information may help adversaries to further their operation within a network. Adversaries may use the information from Query Registry during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Created: May 31, 2017, 9:30 PM UTC
Modified: May 12, 2026, 3:12 PM UTC

25 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Windows Hosts File Access	Informational	Splunk security content	Oct 6, 2026	Apache License 2.0
Windows Credential Access From Browser Password Store	Informational	Splunk security content	Oct 6, 2026	Apache License 2.0
Enumeration Command Spawned via WMIPrvSE	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Microsoft Entra ID Local Device Join Information and Transport Key Registry Keys Access	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Query Registry via reg.exe	Low	Elastic detection rules	Aug 27, 2026	Elastic License 2.0
Windows Software Discovery Via PowerShell	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0
Windows Registry Entries Restored Via Reg	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
Windows Registry Entries Exported Via Reg	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
Windows Query Registry UnInstall Program List	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0
Windows Query Registry Browser List Application	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0
Windows Product Key Registry Query	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0
Windows Post Exploitation Risk Behavior	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0
Windows Non Discord App Access Discord LevelDB	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0
Windows Credentials from Password Stores Chrome Login Data Access	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0
Windows Credentials from Password Stores Chrome LocalState Access	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0
Windows Credentials from Password Stores Chrome Extension Access	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0
Registry Enumeration via WMI Stdregprov	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Exports Registry Key To a File	Low	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Exports Critical Registry Keys To a File	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Potential Configuration And Service Reconnaissance Via Reg.EXE	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
HackTool - PCHunter Execution	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
SysKey Registry Keys Access	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
SAM Registry Hive Handle Request	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Azure AD Health Service Agents Registry Keys Access	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Azure AD Health Monitoring Agent Registry Keys Access	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1

Showing 25 of 25

Filter in the catalogue

External references

mitre-attackT1012Open reference

Wikipedia Windows RegistryOpen reference

Platforms

Windows

Kill chain phases

discovery

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object