T1012Discovery
Query Registry
Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software. The Registry contains a significant amount of information about the operating system, configuration, software, and security. Information can easily be queried using the Reg utility, though other means to access the Registry exist. Some of the information may help…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
14 Sigma rules tagged T1012Query RegistryT101214 general rules
- Exports Critical Registry Keys To a Filehightest
- HackTool - PCHunter Executionhightest
- Operation Wocao Activityhightest
- Operation Wocao Activity - Securityhightest
- Potential Baby Shark Malware Activityhightest
- SAM Registry Hive Handle Requesthightest
- SysKey Registry Keys Accesshightest
- Azure AD Health Monitoring Agent Registry Keys Accessmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Query Registry
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.