Query Registry via reg.exe

Enumeration or discovery of the Windows registry using reg.exe. This information can be used to perform follow-on activities.

Detection logic

Its licence does not clear it for publishing here

Sunturai publishes a detection's own text where the licence it arrived under has been reviewed and permits it, and Elastic License 2.0 has not. The query as its source wrote it, its canonical form and the hash that pins this revision are in the workspace record.

Detection requirements

Platform: Windows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
Log source category: event_index

Detection rules

Query Registry via reg.exe

Detection logic

Detection requirements

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules