Possible Configuration And Service Recon Through Reg.EXE (via process_creation)

title: Possible Configuration And Service Recon Through Reg.EXE (via process_creation)
id: cfa3328d-49dc-5e0c-b40a-09c4f2258cf7
status: stable
description: This rule detects the use of "reg.exe" to query reconnaissance information from the registry. Threat actors may interact with the Windows registry to gather information about credentials, the system, configuration, and installed software.
references:
    - https://attack.mitre.org/techniques/T1007/
    - https://attack.mitre.org/techniques/T1012/
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1012/T1012.md
author: Huntrule Team
date: 2026-02-03
tags:
    - attack.discovery
    - attack.t1012
    - attack.t1007
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\reg.exe'
        - OriginalFileName: 'reg.exe'
    selection_flag:
        CommandLine|contains: 'query'
    selection_key:
        CommandLine|contains:
            - 'currentVersion\windows'
            - 'winlogon\'
            - 'currentVersion\shellServiceObjectDelayLoad'
            - 'currentVersion\run'
            - 'currentVersion\policies\explorer\run'
            - 'currentcontrolset\services'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium