Windows Process Discovery via Registry Queries (reg.exe and PowerShell)

title: Windows Process Discovery via Registry Queries (reg.exe and PowerShell)
id: 965f1e04-3b43-44cb-b7bf-4d2ddffa5c37
status: experimental
description: This rule identifies Windows processes attempting to enumerate system information from the registry using registry query activity. It matches reg.exe executions with “query” and verbose flags, as well as PowerShell commands that use Get-ItemPropertyValue/gpv, combined with registry paths commonly used for OS, Defender, installed software, time zone, and services discovery. This behavior matters because attackers often gather host and software configuration to tailor follow-on actions, and the rule relies on process creation telemetry including the process image path and command-line arguments.
references:
  - https://cert.gov.ua/article/6277849
  - https://github.com/redcanaryco/atomic-red-team/blob/75fa21076dcefa348a7521403cdd6bfc4e88623c/atomics/T1082/T1082.md
  - https://github.com/redcanaryco/atomic-red-team/blob/75fa21076dcefa348a7521403cdd6bfc4e88623c/atomics/T1124/T1124.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_discovery_via_reg_queries.yml
author: lazarg, Huntrule Team
date: 2025-06-12
modified: 2025-10-25
tags:
  - attack.discovery
  - attack.t1082
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmd_reg:
    Image|endswith: \reg.exe
    CommandLine|contains: query
    CommandLine|contains|windash: -v
  selection_cmd_powershell:
    Image|endswith:
      - \powershell.exe
      - \pwsh.exe
    CommandLine|contains:
      - Get-ItemPropertyValue
      - gpv
  selection_keys:
    CommandLine|contains:
      - \SOFTWARE\Microsoft\Windows Defender
      - \SOFTWARE\Microsoft\Windows NT\CurrentVersion
      - \SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
      - \SYSTEM\CurrentControlSet\Control\TimeZoneInformation
      - \SYSTEM\CurrentControlSet\Services
  condition: 1 of selection_cmd_* and selection_keys
falsepositives:
  - Unlikely
level: low
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_discovery_via_reg_queries/info.yml
simulation:
  - type: atomic-red-team
    name: System Information Discovery
    technique: T1010
    atomic_guid: 66703791-c902-4560-8770-42b8a91f7667
  - type: atomic-red-team
    name: Discover OS Product Name via Registry
    technique: T1082
    atomic_guid: be3b5fe3-a575-4fb8-83f6-ad4a68dd5ce7
  - type: atomic-red-team
    name: Discover OS Build Number via Registry
    technique: T1082
    atomic_guid: acfcd709-0013-4f1e-b9ee-bc1e7bafaaec
license: DRL-1.1
related:
  - id: 0022869c-49f7-4ff2-ba03-85ac42ddac58
    type: derived